Yea I have this too... Done all that is in my expertise with no luck... No pop-ups save the dos window and error, any help is much appreciated.

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. You can download Hijack This at this link http://www.tomcoyote.org/hjt/ then place it into a folder of it's on, such as C:\HJT, so that back up copies can be made and not clutter your desktop or other folders and the backup copies of deleted items can be easily located if needed. Once saved double click HijackThis.exe, and press "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that, save the log, Ctrl-A to Select All, and copy its contents into the text editor at this forum. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

You are infected with the Crystalys Media adware. You can remove it manually. Read these instructions.

I think I killed part of my problem last night; however my hijack-this log looks much more clustered than my last... What is all that IE stuff? I don't ever use IE. Looks malicious to me... Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\WMP54GS Wireless Network Monitor\WLService.exe C:\Program Files\WMP54GS Wireless Network Monitor\WMP54G.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\TPPALDR.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\Program Files\HP DVD\Umbrella\DVDTray.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\?ystem32\m?iexec.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\WNSXS~1\scanregw.exe C:\MalKillz\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe" O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /IMEName O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [Gadwin PrintScreen 3.1] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R O4 - HKCU\..\Run: [Aida] "C:\WINDOWS\system32\WNSXS~1\scanregw.exe" -vt ndrv O4 - HKCU\..\Run: [Axbwm] C:\Program Files\?ystem32\m?iexec.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: SpeedUpMyPC.lnk = C:\Program Files\LIUtilities\SpeedUpMyPC\speedupmypc.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: winjks32 - winjks32.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Fasdfpntamua - ewido networks - (no file) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMP54GS Wireless Network Monitor\WLService.exe" "WMP54G.exe (file missing)

Please download "avenger" from this link http://swandog46.geekstogo.com/avenger.zip to your desktop. We will need it later. Please download ATF-Cleaner from this link http://www.atribune.org/content/view/19/2/ by Atribune. Download Ewido Security Suite then set it up this way Ewido Setup Instructions reboot into Safe Mode and run Ewido When the scan has completed, Ewido will create a report.txt file. Click the "Save Report" button on the bottom of the screen and save the log to your desktop. Run HT again from safe mode, close all windows and browsers except HT, place a check to the left of the following items and press "fix checked: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R 0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com O4 - HKCU\..\Run: [Aida] "C:\WINDOWS\system32\WNSXS~1\scanregw.exe" -vt ndrv O4 - HKCU\..\Run: [Axbwm] C:\Program Files\?ystem32\m?iexec.exe O20 - Winlogon Notify: winjks32 - winjks32.dll (file missing) Run ATF-Cleaner. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Open Avenger that you downloaded earlier. Choose "Input script manually" then click the magnifying glass icon Copy the following bold text and paste into the box that opens: Files To Delete: C:\WINDOWS\system32\WNSXS~1\scanregw.exe Folders To Delete: C:\Program Files\?ystem32 Click 'Done' Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC. Please post the Ewido log,post the Avenger output.txt, which you can find at C:\Avenger\.txt, and a new HT log.

Here we go... ewido anti-malware - Scan report + Created on: 6:12:38 PM, 4/4/2006 + Report-Checksum: 4F7917D3 + Scan result: :mozilla.13:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.14:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.15:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.16:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup :mozilla.17:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.18:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.19:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.20:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.21:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.22:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.23:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.26:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup :mozilla.43:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.44:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.45:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup :mozilla.54:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.55:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.56:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.57:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.58:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup :mozilla.59:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup :mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup :mozilla.63:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup :mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup :mozilla.65:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup :mozilla.69:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Bfast : Cleaned with backup :mozilla.78:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.79:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.80:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.81:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.82:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.87:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup :mozilla.88:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup :mozilla.89:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup :mozilla.90:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup :mozilla.107:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup :mozilla.114:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup :mozilla.115:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup :mozilla.116:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup :mozilla.119:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.120:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.121:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup :mozilla.122:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup :mozilla.123:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup :mozilla.124:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.125:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup :mozilla.126:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.128:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup :mozilla.130:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.132:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.136:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup :mozilla.140:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.142:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.143:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.144:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.145:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.146:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.147:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.149:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.150:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.151:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup :mozilla.152:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup :mozilla.153:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.154:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.155:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.156:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup :mozilla.157:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup :mozilla.164:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup :mozilla.188:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup :mozilla.197:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.198:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.199:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.200:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.201:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.202:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.203:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.204:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.205:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.206:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.207:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.208:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.209:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.216:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup :mozilla.217:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup :mozilla.224:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup :mozilla.255:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup :mozilla.256:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup :mozilla.277:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup :mozilla.278:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.279:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.280:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.281:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.282:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.283:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup :mozilla.284:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup :mozilla.285:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup :mozilla.286:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup :mozilla.296:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup :mozilla.324:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.337:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup :mozilla.369:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup :mozilla.399:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned with backup :mozilla.421:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Realtracker : Cleaned with backup :mozilla.422:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\xp69xm9v.default\cookies.txt -> TrackingCookie.Realtracker : Cleaned with backup C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup ::Report End Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ppbdxcky ******************* Script file located at: \??\C:\WINDOWS\worjfnwi.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\WNSXS~1\scanregw.exe deleted successfully. Could not open folder C:\Program Files\?ystem32 for deletion Deletion of folder C:\Program Files\?ystem32 failed! Could not process line: C:\Program Files\?ystem32 Status: 0xc0000033 Completed script processing. ******************* Finished! Terminate. Logfile of HijackThis v1.99.1 Scan saved at 6:18:09 PM, on 4/4/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\NOTEPAD.exe C:\MalKillz\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe" O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /IMEName O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [Gadwin PrintScreen 3.1] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: SpeedUpMyPC.lnk = C:\Program Files\LIUtilities\SpeedUpMyPC\speedupmypc.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: Fasdfpntamua - ewido networks - (no file) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe O23 - Service: WMP54GSVC - Unknown owner - C:\Program Files\WMP54GS Wireless Network Monitor\WLService.exe" "WMP54G.exe (file missing)