Need Help! Tons of Pop Ups, can't uninstall video activex object 2.07

[HeelFever]

Let me start out by saying this is my first post and my computer knowledge is limited. I accidentally downloaded video activex object 2.07 and now am getting pop ups like every 2 minutes. When I try to uninstall it I get a message that says I need to reboot the computer first. Also, there are 2 flashing icons in my toolbar that were not there before. They send me to the virus protect pro and antivirus golden website. Internet explorer also has a new toolbar called Internet Explorer securebar. I have no idea where to begin to get rid of all these problems. I have Norton, but it doesn't recognize any problems.

Could someone please help me get rid of this stuff?

Thanks!

 

[JSntgRvr]

Hi, HeelFever.

Welcome to TSG.

Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the rest of the prompts from there.

If the above link is broken, try this link. Make sure you extract and save the Hijackthis.exe file in a Permanent folder, rather than a Temp folder.

Please download SmitfraudFix (by S!Ri) to your Desktop.

Note: In the event you already have SmitfraudFix, this is a new version that I need you to download.

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• 
  Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program

1. Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
3. On the main screen select the icon "Update" then select the "Update now" link.
   • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
6. Under "Reports"
   • Select "Automatically generate report after every scan"
   • Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly


Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode.

Boot into Safe Mode:

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Perform the following steps in safe mode:

1. 
   IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
2. Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
4. AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
   Once the scan is complete do the following:
5. If you have any infections you will prompted, then select "Apply all actions"
6. Next select the "Reports" icon at the top.
7. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
8. Close AVG Anti-Spyware .

While in Safe Mode, double-click on SmitfraudFix.exe

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.

Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

* Go to Control Panel > Internet Options. Click on the Programs tab, then click the "Reset Web Settings" button. Click Apply then OK.

* Next go to Control Panel > Display. Click on the "Desktop" tab then click the "Customize Desktop" button. Click on the "Web" tab. Under "Web Pages" Delete everything except for "My Current Home Page". Click OK then Apply and OK.

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Open Hijackthis and perform a scan. Save and post a Hijackthis log along with the AVG Anti-spyware report, ActiveScan report and contents of C:\rapport.txt produced by Smitfraudfix.

 

[HeelFever]

Alright, I followed your instructions and here is what I got.

Logfile of HijackThis v1.99.1
Scan saved at 10:22:19 PM, on 7/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\AIM6\aolsoftware.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DISC\DiscUpdMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC10.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG10.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file:///C:/Program%20Files/AutoCAD%202002/InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file:///C:/Program%20Files/AutoCAD%202002/InstFred.ocx
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax4929.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


SmitFraudFix v2.200

Scan done at 21:06:04.32, Wed 07/04/2007
Run from C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
DNS Server Search Order: 16.92.3.242
DNS Server Search Order: 16.92.3.243
DNS Server Search Order: 16.81.3.243
DNS Server Search Order: 16.118.3.243

Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
HKLM\SYSTEM\CCS\Services\Tcpip\..\{EB3B2980-D130-43F4-A869-94833DD985F4}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EB3B2980-D130-43F4-A869-94833DD985F4}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EB3B2980-D130-43F4-A869-94833DD985F4}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

[HeelFever]

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 7:05:50 PM 7/4/2007

+ Scan result:



HKLM\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP163\A0022473.ini -> Adware.Qworke : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP164\A0022614.exe -> Adware.Virusprotectpro : Cleaned with backup (quarantined).
C:\Program Files\Video ActiveX Access\iesbunst.exe -> Downloader.Zlob.awv : Cleaned with backup (quarantined).
C:\Program Files\Video ActiveX Access\imsmn.exe -> Downloader.Zlob.btq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP163\A0022464.exe -> Downloader.Zlob.btq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP163\A0022497.exe -> Downloader.Zlob.btq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP164\A0022561.exe -> Downloader.Zlob.btq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP164\A0022586.exe -> Downloader.Zlob.btq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP164\A0022622.dll -> Hijacker.Agent.jw : Cleaned with backup (quarantined).
C:\WINDOWS\system32\nuqjici.dll -> Hijacker.Agent.jw : Cleaned with backup (quarantined).
C:\Program Files\Gay-Lesbian-Photo\Gay-Lesbian-Photo.exe -> Hijacker.Delf.fz : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP162\A0021926.exe -> Hijacker.Delf.fz : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP162\A0021927.exe -> Hijacker.Delf.fz : Cleaned with backup (quarantined).
C:\Program Files\music_now\inetchk.exe -> Hijacker.Small : Cleaned with backup (quarantined).
:mozilla.692:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.695:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.161:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.164:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.165:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.166:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.168:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.308:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.313:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.495:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.766:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.565:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adengage : Cleaned.
:mozilla.346:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.57:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.58:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.59:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.60:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.61:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.65:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.361:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.362:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.363:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.790:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.791:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.466:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.467:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.169:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.170:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.171:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.172:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.42:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.357:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.358:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.359:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.360:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.671:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.28:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.29:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.35:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.36:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.37:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.38:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.39:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.40:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.768:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.769:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.154:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned.
:mozilla.94:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.95:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.725:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Live : Cleaned.
:mozilla.726:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Live : Cleaned.
:mozilla.727:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Live : Cleaned.
:mozilla.733:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.111:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.70:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.801:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.155:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.103:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.104:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.105:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.106:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.31:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.32:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.33:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.34:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.449:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.450:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.451:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.452:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.372:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.373:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.374:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.375:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.376:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.377:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.378:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.379:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.380:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.427:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.429:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.430:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.431:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.432:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.436:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.526:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.527:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.528:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.529:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.530:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.531:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.532:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.533:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.534:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.535:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.536:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.537:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.538:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.539:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.540:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.541:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.542:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.543:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.544:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.545:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.546:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.547:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.548:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.549:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.550:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.551:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.745:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.746:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.747:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.748:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.502:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.503:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.504:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.505:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.506:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.603:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.604:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.605:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.606:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.607:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.507:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.508:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.509:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.510:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.511:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.512:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.513:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.514:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.515:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.516:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.517:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.518:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.519:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.520:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.364:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.365:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.366:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.367:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.129:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.134:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.135:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.136:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.137:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.138:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.139:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.141:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.107:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.67:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.130:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.131:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.132:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.133:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.140:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.142:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.143:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.368:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.369:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.370:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.371:C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.


::Report end

 

[HeelFever]

Incident Status Location

Adware:adware/xmllib Not disinfected Windows Registry
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt[.go.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt[winantispyware.com/]
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt[go.winantispyware.com/MTg4NQ==/2/702/antispyware/]
Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\qupg1foe.default\cookies.txt[.webpower.com/]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix\Process.exe
Virus:Trj/Shutdown.Z Disinfected C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix\restart.exe
Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe
Virus:Trj/Lineage.CWB Disinfected C:\Program Files\HP Games\Bejeweled 2 Deluxe\WinBej2-WT.exe
Spyware:Spyware/PeoplePC Not disinfected C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\RAS.DLL
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe

I hope it was okay to just copy and paste everything in.
Do I need to do anything else?

Thanks for your help.

 

[JSntgRvr]

Hi, HeelFever

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)


Now close all windows and browsers, other than HiJackThis, then click Fix Checked.

Close Hijackthis.

• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\Program Files\Video ActiveX Access
  C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\RAS.DLL
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
  • If able, copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on a note pad document. Save it on the desktop and post its contents in your next reply.
• Close OTMoveIt

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

The rest looks clear. How is it doing?

 

[HeelFever]

I haven't been getting any pop ups lately and the icons on my toolbar are gone. Here is what i got after running OTMoveIt.

File/Folder C:\Program Files\Video ActiveX Access not found.
DllUnregisterServer procedure not found in C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\RAS.DLL
C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\RAS.DLL NOT unregistered.
C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\RAS.DLL moved successfully.

Created on 07/05/2007 13:02:46

Thanks for all your help

 

[JSntgRvr]

Hi, HeelFever.

Congratulations.

Since the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, as well as the folders created by these tools.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Ugrading Java:

• Download the latest version of Java Runtime Environment (JRE) 6u1.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK..

Create a Restore point:

1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.
2. In the System Restore dialog box, click Create a restore point, and then click Next.
3. Type a description for your restore point, such as "After Cleanup", then click Create.

The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

1. Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.
   
2. AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
   
3. SpywareBlaster - Great prevention tool to keep nasties from installing on your system.
   
4. IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
   
5. CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
   
6. Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
   
7. Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.
   
8. Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.

Click Here for some advise from our security Experts.

Please use the thread's Tools and mark this thread as "Solved".

Best wishes!