My PC contracted a virus of some sort a couple of days ago (probably a trojan), and spam emails are being sent through my system on my behalf. I am running Norton Antivirus 2006, but it doesn't detect any threats. I have downloaded and installed every Norton and Windows update I have come across with no results. I am running in safe mode now, and have tried running online virus and security scans, and every scan comes up clean. Yet in normal mode, I have hundreds of Symantec Email Proxy alerts stating that my message to whomever@something.com, subject: Stuff about penis enlargement, pharmacies or hot horney chicks, was undeliverable. If I could identify the virus, I could fix it myself. The problem is that nothing seems to recognize this thing. Any suggestions? Perhaps turning off certain services? Is there a way to disable emails and worry about the virus later?

We can try to help, please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue. Put a check by "Create a desktop icon" then click "Next" again. Continue to follow the rest of the prompts from there. At the final dialogue box click "Finish" and it will launch Hijack This. Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly. Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop. !!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!! Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

If you get really stuck try support.com (1-800-PC-SUPPORT) - it's a paid service but I heard from a friend that they will go 150% to solve tough problems.

Thank you for the response! Here is the Hijack This Log: Logfile of HijackThis v1.99.1 Scan saved at 6:03:44 PM, on 1/13/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T... R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T... R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T... R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?T... R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon.exe O4 - HKLM\..\Run: [winlogon] C:\WINDOWS\csrss.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O15 - Trusted Zone: http://*.trymedia.com (HKLM) O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/... O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/act... O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe O23 - Service: Flsl2rvfgi - Unknown owner - C:\WINDOWS\system32\exe2bin.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe - And here is the report from SmitfraudFix: SmitFraudFix v2.132 Scan done at 18:06:57.21, Sat 01/13/2007 Run from C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Administrator\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_ADM~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O4 - HKLM\..\Run: [nvchost] C:\WINDOWS\winlogon.exe O4 - HKLM\..\Run: [winlogon] C:\WINDOWS\csrss.exe Exit Hijack This but remain insafe mode. Navigate to and delete these files if found: C:\WINDOWS\winlogon.exe C:\WINDOWS\csrss.exe Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).Post the AVG-AntiSpyware repost and a new Hijack This log. Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version.

Excellent work, jabuck! I can't tell you how much I appreciate the assistance! So far, so good. Things are pretty quiet around here so far. Here is the AVG Report: AVG Anti-Spyware - Scan Report + Created at: 12:00:18 PM 1/14/2007 + Scan result: C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1\A0000007.exe -> Adware.Trymedia : Cleaned. C:\Documents and Settings\HP_Administrator\Shared\Sonalksis All Plugins Bundle VST DX RTAS v1.28.zip/Sonalksis.All.Plugins.Bundle.VST.DX.RTAS.v1.28.incl.Keygen-AiR/Keygen.exe -> Dropper.Delf.xo : Cleaned. C:\Documents and Settings\HP_Administrator\Shared\Sonalksis All Plugins Bundle VST DX RTAS v1.28.zip/Sonalksis.All.Plugins.Bundle.VST.DX.RTAS.v1.28.incl.Keygen-AiR/Setup.exe -> Dropper.Delf.xo : Cleaned. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DP1A.exe -> Proxy.Agent.kj : Cleaned. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DP50.exe -> Proxy.Agent.kj : Cleaned. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DP52.exe -> Proxy.Agent.kj : Cleaned. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DPC7.exe -> Proxy.Agent.kj : Cleaned. C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1\A0000011.exe -> Proxy.Agent.kj : Cleaned. :mozilla.186:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.249:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.250:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.251:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.252:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.253:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.254:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.255:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.256:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.257:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.258:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.259:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.260:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.261:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.262:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.263:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.264:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.265:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.266:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.267:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.268:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.208:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.45:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.46:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.178:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned. :mozilla.92:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.93:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.94:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.95:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.154:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.334:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned. :mozilla.16:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.68:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.69:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.70:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.71:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.245:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.333:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.15:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.193:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.231:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.244:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.328:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.34:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.67:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.82:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.11:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.12:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.13:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.14:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.157:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.158:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.159:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.160:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.161:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.289:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.75:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.76:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.96:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.105:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.106:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.107:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.108:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned. :mozilla.145:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.146:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.225:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.226:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.227:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.338:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.88:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.89:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.90:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.91:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.325:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.326:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.327:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.221:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.222:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.223:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.224:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.168:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned. :mozilla.169:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned. :mozilla.170:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned. :mozilla.24:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.25:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.26:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.27:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.28:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.58:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.59:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.60:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.61:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.62:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.63:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.64:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.65:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.66:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.293:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.294:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.295:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.296:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.297:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.298:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.299:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.300:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.198:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.199:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.200:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.155:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.149:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.150:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.151:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.152:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.153:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.139:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.140:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.141:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\69z23d6w.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. ::Report end ------------------- Here is the HijackThis log: Logfile of HijackThis v1.99.1 Scan saved at 12:36:29 PM, on 1/14/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T... R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe" O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O15 - Trusted Zone: http://*.trymedia.com (HKLM) O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/... O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/act... O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe O23 - Service: Flsl2rvfgi - Unknown owner - C:\WINDOWS\system32\exe2bin.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ---------------- And the Combofix log: "HP_Administrator" - 07-01-14 12:26:25 Service Pack 2 ComboFix 07-01-14.2 - Running from: "C:\Documents and Settings\HP_Administrator\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\INSTALL.LOG ((((((((((((((((((((((((((((((( Files Created from 2006-12-14 to 2007-01-14 )))))))))))))))))))))))))))))))))) 2007-01-14 11:09 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-14 11:09 <DIR> d-------- C:\Program Files\Grisoft 2007-01-13 18:06 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe 2007-01-13 18:06 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-01-13 18:06 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-01-13 18:06 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2007-01-13 18:06 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-01-13 18:06 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2007-01-13 18:06 1,856 --a------ C:\WINDOWS\system32\tmp.reg 2007-01-13 18:02 <DIR> d-------- C:\Program Files\Hijackthis 2007-01-13 14:55 28,672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys 2007-01-13 14:51 153,088 --a------ C:\WINDOWS\system32\UNWISE.exe 2007-01-13 14:51 <DIR> d-------- C:\Program Files\EarthLink 2007-01-13 13:21 <DIR> d-------- C:\Program Files\PodUtil 2007-01-13 12:24 845,312 --a------ C:\WINDOWS\system32\Smab.dll 2007-01-13 12:24 719,872 --a------ C:\WINDOWS\system32\devil.dll 2007-01-13 12:24 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-01-13 12:24 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll 2007-01-13 12:24 66,560 --a------ C:\WINDOWS\MOTA113.exe 2007-01-13 12:24 502,784 --a------ C:\WINDOWS\x2.64.exe 2007-01-13 12:24 306,688 --a------ C:\WINDOWS\system32\avisynth.dll 2007-01-13 12:24 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll 2007-01-13 12:24 240,128 --a------ C:\WINDOWS\system32\x.264.exe 2007-01-13 12:24 217,073 --a------ C:\WINDOWS\meta4.exe 2007-01-13 12:24 <DIR> d-------- C:\WINDOWS\system32\ShellDHCP 2007-01-13 12:24 <DIR> d-------- C:\Program Files\AviSynth 2.5 2007-01-13 10:48 <DIR> d-------- C:\Fonts 2007-01-13 00:05 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2007-01-12 22:53 <DIR> d-------- C:\WINDOWS\WBEM 2007-01-12 22:53 <DIR> d-------- C:\WINDOWS\system32\en-US 2007-01-12 22:51 <DIR> d--h-c--- C:\WINDOWS\ie7 2007-01-12 22:48 121,856 --------- C:\WINDOWS\system32\xmllite.dll 2007-01-12 22:47 <DIR> d-------- C:\WINDOWS\network diagnostic 2007-01-12 22:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Windows Genuine Advantage 2007-01-12 22:02 <DIR> d-------- C:\Program Files\Symantec Technical Support 2007-01-12 13:47 <DIR> d-------- C:\Program Files\Synchro Arts Ltd 2007-01-12 13:46 <DIR> d-------- C:\Program Files\Serato 2007-01-12 13:45 <DIR> d-------- C:\Program Files\GRM Tools RTAS 1.0.4 2007-01-12 13:44 <DIR> d-------- C:\Program Files\IK Multimedia 2007-01-12 13:39 <DIR> d-------- C:\Program Files\Antares 2007-01-12 13:38 <DIR> d-------- C:\Program Files\Antares Audio Technologies 2007-01-12 13:37 163,840 --a------ C:\WINDOWS\system32\ArtFfct.dll 2007-01-12 13:37 <DIR> d-------- C:\Program Files\Arturia 2007-01-12 13:36 <DIR> d-------- C:\Program Files\FXpansion 2007-01-12 13:36 <DIR> d-------- C:\Program Files\db-audioware 2007-01-12 13:34 <DIR> d-------- C:\Program Files\iZotope 2007-01-12 13:33 69,632 --a------ C:\WINDOWS\system32\NI_DFD_1_2_2.dll 2007-01-12 13:33 54,272 --a------ C:\WINDOWS\system32\KERNELO2.DLL 2007-01-12 13:32 543,232 --a------ C:\WINDOWS\LOOP.exe 2007-01-12 13:32 <DIR> d-------- C:\Program Files\Native Instruments 2007-01-12 13:32 <DIR> d-------- C:\Program Files\Digidesign 2007-01-12 13:31 <DIR> d-------- C:\WINDOWS\vocoder 2007-01-12 13:31 <DIR> d-------- C:\Program Files\Waves 2007-01-12 13:25 129,024 --a------ C:\WINDOWS\UNWISE.exe 2007-01-12 13:19 <DIR> d-------- C:\Program Files\Image-Line 2007-01-12 13:14 <DIR> d-------- C:\SpeedSoft 2007-01-12 13:13 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Help 2007-01-12 12:41 <DIR> d-------- C:\Program Files\YAMAHA 2007-01-12 12:25 2,756 --a------ C:\WINDOWS\system32\ssoleth.dll 2007-01-12 12:25 2,756 --a------ C:\WINDOWS\system32\sslibrh.dll 2007-01-12 12:25 2,756 --a------ C:\WINDOWS\system32\sslibjtd.dll 2007-01-12 12:25 2,756 --a------ C:\WINDOWS\system32\sslibdd.dll 2007-01-12 12:25 2,756 --a------ C:\WINDOWS\system32\slibrh.dll 2007-01-12 12:25 2,756 --a------ C:\WINDOWS\system32\olejttd.dll 2007-01-12 12:24 673,610 --a------ C:\WINDOWS\unins000.exe 2007-01-12 12:24 <DIR> d-------- C:\Program Files\Sonalksis 2007-01-12 12:24 <DIR> d-------- C:\Program Files\Common Files\Digidesign 2007-01-12 12:23 <DIR> d-------- C:\Program Files\Sonitus-fx-R3 2007-01-12 10:42 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Application Data\Adobe 2007-01-12 10:20 <DIR> d-------- C:\~intuit.sys 2007-01-12 09:19 <DIR> d-------- C:\Program Files\Mozilla Firefox 2007-01-12 09:05 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\MSNInstaller 2007-01-11 17:36 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\HPQ 2007-01-11 14:09 <DIR> d-------- C:\Downloads 2007-01-11 14:08 <DIR> d-------- C:\Program Files\Game Setup Files 2007-01-11 11:04 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\AdobeUM 2007-01-11 11:03 <DIR> d-------- C:\PC Info 2007-01-10 11:57 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Cakewalk 2007-01-10 11:56 258,048 --a------ C:\WINDOWS\system32\REX Shared Library.dll 2007-01-10 11:56 180,224 --a------ C:\WINDOWS\system32\ReWire.dll 2007-01-10 11:56 <DIR> d-------- C:\Program Files\Cakewalk 2007-01-10 11:56 <DIR> d-------- C:\Cakewalk Projects 2007-01-10 03:02 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-01-10 03:02 <DIR> d-------- C:\ae886fdd014b5a94d613d7ff8a2a42 2007-01-09 16:30 <DIR> d-------- C:\WINDOWS\Sun 2007-01-09 16:30 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Sun 2007-01-09 16:08 <DIR> d-------- C:\Azure Flame Files 2007-01-09 12:33 <DIR> d-------- C:\Program Files\WinZip Self-Extractor 2007-01-09 11:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Adobe Systems 2007-01-09 11:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Adobe 2007-01-09 11:15 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Adobe 2007-01-09 11:12 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-01-09 11:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Macrovision 2007-01-09 11:07 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2007-01-09 11:06 <DIR> d-------- C:\Program Files\Common Files\L&H 2007-01-09 03:18 23,040 --------- C:\WINDOWS\kb913800.exe 2007-01-09 03:00 <DIR> d-------- C:\WINDOWS\system32\PreInstall 2007-01-09 01:17 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Sonic 2007-01-09 01:16 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Leadertech 2007-01-09 00:39 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Apple Computer 2007-01-09 00:38 <DIR> d-------- C:\Program Files\QuickTime 2007-01-09 00:36 <DIR> d-------- C:\Program Files\iTunes 2007-01-09 00:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Apple Computer 2007-01-09 00:34 38,229 --------- C:\WINDOWS\system32\drivers\StMp3Rec.sys 2007-01-09 00:33 <DIR> d-------- C:\Program Files\iPod 2007-01-09 00:20 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Sonic Foundry 2007-01-09 00:20 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\NetMedia Providers 2007-01-09 00:16 <DIR> d-------- C:\Program Files\Sonic Foundry 2007-01-09 00:15 665,424 --a------ C:\WINDOWS\system32\wmv8dmoe.dll 2007-01-09 00:15 566,272 --a------ C:\WINDOWS\system32\wmvdmoe.dll 2007-01-09 00:15 438,608 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2007-01-09 00:15 1,683,792 --a------ C:\WINDOWS\system32\wmvcore2.dll 2007-01-09 00:09 <DIR> d-------- C:\Program Files\VSTplugins 2007-01-09 00:09 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Sony 2007-01-09 00:09 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Publish Providers 2007-01-09 00:08 <DIR> d-------- C:\Program Files\Sony 2007-01-09 00:06 <DIR> d--h----- C:\WINDOWS\PIF 2007-01-08 23:57 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Symantec 2007-01-08 23:53 10,344 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys 2007-01-08 23:53 <DIR> d-------- C:\Program Files\Norton AntiVirus 2007-01-08 23:52 48,776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-01-08 23:52 115,000 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-01-08 23:52 <DIR> d-------- C:\Program Files\Symantec 2007-01-08 23:46 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2007-01-08 23:46 <DIR> d-------- C:\Program Files\FriendBlasterPro 2007-01-08 23:27 82,944 --a------ C:\WINDOWS\system32\usbmn1x1.dll 2007-01-08 23:27 724,992 --a------ C:\WINDOWS\iun6002.exe 2007-01-08 23:27 22,272 --a------ C:\WINDOWS\system32\drivers\usbmn1x1.sys 2007-01-08 23:27 13,504 --a------ C:\WINDOWS\system32\drivers\usb11ldr.sys 2007-01-08 23:27 <DIR> d-------- C:\Program Files\M-Audio Midisport 1x1 2007-01-08 23:26 430,080 -ra------ C:\WINDOWS\system32\hp4850co.dll 2007-01-08 23:26 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-01-08 23:23 <DIR> d-------- C:\Program Files\US122_Install 2007-01-08 23:10 <DIR> d-------- C:\bin 2007-01-08 23:09 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2007-01-08 23:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\HP 2007-01-08 23:02 <DIR> d-------- C:\Program Files\COL10861 2007-01-08 22:58 <DIR> d-------- C:\audio 2007-01-08 22:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Avery 2007-01-08 22:46 <DIR> d-------- C:\Program Files\Avery Dennison 2007-01-08 22:33 634,087 --a------ C:\WINDOWS\cd32.exe 2007-01-08 22:33 61,952 --a------ C:\WINDOWS\system32\nabapi32.dll 2007-01-08 22:33 299,520 --a------ C:\WINDOWS\uninst.exe 2007-01-08 22:33 112,128 --a------ C:\WINDOWS\system32\mapi32bak.dll 2007-01-08 22:33 <DIR> d-------- C:\WINDOWS\ShellNew 2007-01-08 22:33 <DIR> d-------- C:\WINDOWS\aim95 2007-01-08 22:09 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll 2007-01-08 22:09 <DIR> d-------- C:\Program Files\eRightSoft 2007-01-08 22:03 <DIR> d-------- C:\Program Files\Program Setup Files 2007-01-08 22:03 <DIR> d-------- C:\Program Files\Additional Drivers 2007-01-08 21:45 <DIR> d--hs---- C:\DOCUME~1\HP_ADM~1\UserData 2007-01-08 21:40 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Shared 2007-01-08 21:40 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Incomplete 2007-01-08 21:26 <DIR> d-------- C:\Program Files\LimeWire 2007-01-08 21:25 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\.limewire 2007-01-08 21:09 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-01-08 21:07 <DIR> d--hs---- C:\RECYCLER 2007-01-08 20:59 <DIR> d--hs---- C:\cmdcons 2007-01-08 20:59 <DIR> d-------- C:\WINDOWS\setupupd 2007-01-08 20:59 <DIR> d-------- C:\WINDOWS\setup.pss 2007-01-08 20:59 <DIR> d-------- C:\WINDOWS\pss 2007-01-08 20:54 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\WINDOWS 2007-01-08 20:54 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Real 2007-01-08 20:54 <DIR> d-------- C:\DOCUME~1\HP_ADM~1\Application Data\Intuit 2007-01-08 20:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\WINDOWS 2007-01-08 20:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Application Data\Real 2007-01-08 20:52 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Application Data\Intuit 2007-01-08 20:50 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-01-08 20:50 <DIR> d-------- C:\WINDOWS\Prefetch 2007-01-08 20:42 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-01-08 20:17 <DIR> d--hs---- C:\System Volume Information (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-13 13:42 104997 --a------ C:\DOCUME~1\HP_ADM~1\Application Data\com.kennettnet.podutil.plist 2007-01-13 13:11 14 --a------ C:\DOCUME~1\HP_ADM~1\Application Data\podutil preferences 2007-01-12 23:34 -------- d-------- C:\Program Files\Common Files\symantec shared 2007-01-12 21:38 -------- d---s---- C:\DOCUME~1\HP_ADM~1\Application Data\microsoft 2007-01-12 13:44 -------- d--h----- C:\Program Files\installshield installation information 2007-01-12 11:17 -------- d-------- C:\Program Files\englishotto 2007-01-12 09:19 -------- d-------- C:\DOCUME~1\HP_ADM~1\Application Data\mozilla 2007-01-11 13:18 -------- d-------- C:\DOCUME~1\HP_ADM~1\Application Data\macromedia 2007-01-09 12:29 -------- d-------- C:\Program Files\macromedia 2007-01-09 12:29 -------- d-------- C:\Program Files\Common Files\macromedia 2007-01-09 11:28 -------- d-------- C:\Program Files\Common Files\adobe 2007-01-08 22:43 -------- d-------- C:\Program Files\hewlett-packard 2007-01-08 22:33 -------- d-------- C:\Program Files\netscape 2007-01-08 21:09 -------- d-------- C:\Program Files\quicken 2006-12-06 23:14 2330624 --a------ C:\WINDOWS\system32\wmvcore.dll 2006-11-08 00:06 679424 --------- C:\WINDOWS\system32\inetcomm.dll 2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll 2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll 2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll 2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll 2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll 2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll 2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll 2006-10-19 08:56 713216 --a------ C:\WINDOWS\system32\sxs.dll 2006-10-17 12:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-10-17 12:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-10-17 12:05 206336 --------- C:\WINDOWS\system32\winfxdocobj.exe 2006-10-17 12:05 105984 --a------ C:\WINDOWS\system32\url.dll 2006-10-17 12:04 101376 --a------ C:\WINDOWS\system32\occache.dll 2006-10-17 12:03 17408 --a------ C:\WINDOWS\system32\corpol.dll 2006-10-17 11:58 61952 --------- C:\WINDOWS\system32\icardie.dll 2006-10-17 11:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 11:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll 2006-10-17 11:57 266752 --------- C:\WINDOWS\system32\iertutil.dll 2006-10-17 11:56 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-10-17 11:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-10-17 11:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Acrobat Speed Launcher.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Acrobat Speed Launcher.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\Installer\\{AC76BA86-1033-0000-7760-000000000002}\\SC_Acrobat.exe " "item"="Adobe Acrobat Speed Launcher" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Gamma Loader.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.exe " "item"="Adobe Gamma Loader" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~4\\Office10\\OSA.exe -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Updates From HP.lnk" "backup"="C:\\WINDOWS\\pss\\Updates From HP.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\UPDATE~1\\9972322\\Program\\UPDATE~1.exe -startup" "item"="Updates From HP" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Acrotray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ccApp" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DMAScheduler" "hkey"="HKLM" "command"="\"c:\\Program Files\\HP DigitalMedia Archive\\DMAScheduler.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ehtray" "hkey"="HKLM" "command"="C:\\WINDOWS\\ehome\\ehtray.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ftutil2] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="rundll32" "hkey"="HKLM" "command"="rundll32.exe ftutil2.dll,SetWriteCacheMode" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="hkcmd" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\hkcmd.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HPWuSchd2" "hkey"="HKLM" "command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HPBootOp" "hkey"="HKLM" "command"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Iaanotif" "hkey"="HKLM" "command"="C:\\Program Files\\Intel\\Intel Matrix Storage Manager\\Iaanotif.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="igfxpers" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\igfxpers.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RECGUARD" "hkey"="HKLM" "command"="C:\\WINDOWS\\SMINST\\RECGUARD.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Remind_XP" "hkey"="HKLM" "command"="\"C:\\Windows\\Creator\\Remind_XP.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RTHDCPL" "hkey"="HKLM" "command"="RTHDCPL.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="realsched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\ 63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\ 6d,73,73,74,79,6c,65,73,00 "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\ 73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{122fbfc7-9f7f-11db-aaf2-806d6172696f}] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - HP_Administrator.job Completion time: 07-01-14 12:28:44

Looks better. Navigate to and delete this file if found: C:\WINDOWS\iun6002.exe Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Run ATF-Cleaner.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Doubleclick the drweb-cureit.exe file and Allow to run the express scan. This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, mark the drives that you want to scan. Select all drives. A red dot shows which drives have been chosen. Click the green arrow at the right, and the scan will start. Click 'Yes to all' if it asks if you want to cure/move the file. When the scan has finished, look if you can click next icon next to the files found: If so, click it and then click the next icon right below and select Move incurable. This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples) After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list Save the report to your desktop. The report will be called DrWeb.csv Close Dr.Web Cureit. Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot. After reboot, post the contents of the log on your desktop.