Solved: H E L P ! ! !

[Trebliug]

My PC is showing some serious symptoms which I'm not sure where to start,
I can't update my Norton Symantec Updater....
Microsoft update is not working as well....

Any help would be much appreciated, following is a copy of Hijack This.....

Logfile of HijackThis v1.99.1
Scan saved at 23:28:22, on 19/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\cryn.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\Desktop\HijackThis.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSCNo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {A7030A8B-81B1-9908-1971-009E47C24FCA} - C:\WINDOWS\nettq.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {7D40ADF2-AD68-4959-ACEC-DA96BF5E6EB7} (SpyBouncer.SBDownloader) - http://spywareremover.spybouncer.com/downloader.ocx
O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} - http://66.117.37.13/gba1878.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{851CAB41-432B-42E1-9F78-D4C2D908A39F}: NameServer = 195.92.195.94 195.92.195.95
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlkb.exe" /s (file missing)
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Deepsight Extractor (DeepsightExtractor) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
O23 - Service: DeepSight Extractor Service for NPF03 (ExtractorServiceNPF03) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF03.exe
O23 - Service: DeepSight Extractor Service for NPF04 (ExtractorServiceNPF04) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF04.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

 

[MFDnNC]

Fix these with HJT – mark them, close IE, click fix checked

O2 - BHO: Class - {A7030A8B-81B1-9908-1971-009E47C24FCA} - C:\WINDOWS\nettq.dll

O16 - DPF: {7D40ADF2-AD68-4959-ACEC-DA96BF5E6EB7} (SpyBouncer.SBDownloader) - http://spywareremover.spybouncer.com/downloader.ocx

O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} - http://66.117.37.13/gba1878.exe

O23 - Service: Network Security Service ( 11Fßä #·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlkb.exe" /s (file missing)

DL http://www.downloads.subratam.org/KillBox.zip

Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\WINDOWS\nettq.dll

Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

Exit the Killbox.

Click Start > Run > and type in:

services.msc

Click OK.

In the services window find

Network Security Service

Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. File-Exit the Services utility.

Note: You may get an error here when trying to access the properties of the service. If you do get an error, just select the service and look there in the top left of the main service window and click "Stop" to stop the service. If that gives an error or it is already stopped, just skip this step and proceed with the rest.




START – RUN – type in %temp% OK - Edit – Select all – File – Delete
Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp
Empty the recycle bin
Boot

Download the trial version of Ewido Security Suite http://www.ewido.net/en/download/
· Install ewido.
· During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
· Launch ewido
· It will prompt you to update click the OK button and it will go to the main screen
· On the left side of the main screen click update
· Click on Start and let it update.
· DO NOT run a scan yet. You will do that later in safe mode.

Restart your computer into safe mode now. Perform the following steps in safe mode:


Run Ewido:
· Click on scanner
· Click Complete System Scan and the scan will begin.
· During the scan it will prompt you to clean files, click OK
· When the scan is finished, look at the bottom of the screen and click the Save report button.
· Save the report to your desktop
This will take some time to run!
Post that log and a new HiJack log


Please give feedback on what worked/didn’t work and the current status of your system

 

[Trebliug]

Thank you for your quick response.
I have done everything as you've instructed apart from running the services.msc and comes up as error.
downloaded Ewido but unable to update this due to connection failure.

Logfile of HijackThis v1.99.1
Scan saved at 00:43:59, on 20/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\cryn.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
C:\Program Files\ewido\security suite\SecuritySuite.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\User\Desktop\HijackThis.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSCNo.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fpmnd.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fpmnd.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {5735E683-CD34-5961-3A6F-D24FC5A02C88} - C:\WINDOWS\ntmv.dll
O2 - BHO: Class - {6BEF21ED-FE12-619A-B05D-D81A14259340} - C:\WINDOWS\atlax32.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {FE3AF541-D539-568E-FF78-F832321D0655} - C:\WINDOWS\system32\iexu32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [cryn.exe] C:\WINDOWS\system32\cryn.exe
O4 - HKLM\..\RunOnce: [atlkb.exe] C:\WINDOWS\system32\atlkb.exe
O4 - HKLM\..\RunOnce: [javajj32.exe] C:\WINDOWS\system32\javajj32.exe
O4 - HKLM\..\RunOnce: [netzz32.exe] C:\WINDOWS\netzz32.exe
O4 - HKLM\..\RunOnce: [netih.exe] C:\WINDOWS\system32\netih.exe
O4 - HKLM\..\RunOnce: [mfcew.exe] C:\WINDOWS\mfcew.exe
O4 - HKLM\..\RunOnce: [sdkbg.exe] C:\WINDOWS\sdkbg.exe
O4 - HKLM\..\RunOnce: [addjw.exe] C:\WINDOWS\addjw.exe
O4 - HKLM\..\RunOnce: [ntkl.exe] C:\WINDOWS\system32\ntkl.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O15 - Trusted Zone: http://download.windowsupdate.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{851CAB41-432B-42E1-9F78-D4C2D908A39F}: NameServer = 195.92.195.94 195.92.195.95
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlkb.exe" /s (file missing)
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Deepsight Extractor (DeepsightExtractor) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: DeepSight Extractor Service for NPF03 (ExtractorServiceNPF03) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF03.exe
O23 - Service: DeepSight Extractor Service for NPF04 (ExtractorServiceNPF04) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF04.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

 

[Trebliug]

By the way my Microsoft Antispyware is always picking Trojan.BHO.NameShifter.Y

Thanks

 

[MFDnNC]

Msc – comes up with error – can you be more detailed

Run the following later just DL them

Download CWShredder http://www.intermute.com/products/cwshredder.html


Service remove - http://forums.techguy.org/attachment.php?attachmentid=45240
· Double-click the cwsserviceremove.reg file you downloaded at the beginning.
· Answer Yes when prompted to add the contents to the registry.

Download About:Buster from:
http://www.majorgeeks.com/download4289.html
Double click aboutbuster.exe, click Update, click OK, click Start, then click OK.

Fix these with HJT – mark them, close IE, click fix checked

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fpmnd.dll/sp.html#44768

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fpmnd.dll/sp.html#44768

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\uazvt.dll/sp.html#44768

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {5735E683-CD34-5961-3A6F-D24FC5A02C88} - C:\WINDOWS\ntmv.dll

O2 - BHO: Class - {6BEF21ED-FE12-619A-B05D-D81A14259340} - C:\WINDOWS\atlax32.dll

O2 - BHO: Class - {FE3AF541-D539-568E-FF78-F832321D0655} - C:\WINDOWS\system32\iexu32.dll

O4 - HKLM\..\Run: [cryn.exe] C:\WINDOWS\system32\cryn.exe
O4 - HKLM\..\RunOnce: [atlkb.exe] C:\WINDOWS\system32\atlkb.exe
O4 - HKLM\..\RunOnce: [javajj32.exe] C:\WINDOWS\system32\javajj32.exe
O4 - HKLM\..\RunOnce: [netzz32.exe] C:\WINDOWS\netzz32.exe
O4 - HKLM\..\RunOnce: [netih.exe] C:\WINDOWS\system32\netih.exe
O4 - HKLM\..\RunOnce: [mfcew.exe] C:\WINDOWS\mfcew.exe
O4 - HKLM\..\RunOnce: [sdkbg.exe] C:\WINDOWS\sdkbg.exe
O4 - HKLM\..\RunOnce: [addjw.exe] C:\WINDOWS\addjw.exe
O4 - HKLM\..\RunOnce: [ntkl.exe] C:\WINDOWS\system32\ntkl.exe

O15 - Trusted Zone: http://download.windowsupdate.com

O23 - Service: Network Security Service ( 11Fßä #·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlkb.exe" /s (file missing)

DL http://www.downloads.subratam.org/KillBox.zip

Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

Close all browser windows,
Open cwshredder.exe then click "Fix" and let it run.


Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\WINDOWS\ntmv.dll
C:\WINDOWS\atlax32.dll
C:\WINDOWS\system32\iexu32.dll
C:\WINDOWS\system32\cryn.exe
C:\WINDOWS\system32\atlkb.exe
C:\WINDOWS\system32\javajj32.exe
C:\WINDOWS\netzz32.exe
C:\WINDOWS\system32\netih.exe
C:\WINDOWS\mfcew.exe
C:\WINDOWS\sdkbg.exe
C:\WINDOWS\addjw.exe
C:\WINDOWS\system32\ntkl.exe

Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

Exit the Killbox.

Open Windows Explorer. Go to Tools, Folder Options and click on the View tab.
Make sure that "Show hidden files and folders" is checked.
Now click "Apply to all folders", Click "Apply" then "OK"

Delete these folders


· Double-click the cwsserviceremove.reg file you downloaded at the beginning.
· Answer Yes when prompted to add the contents to the registry.
Run About Buster again


START – RUN – type in %temp% OK - Edit – Select all – File – Delete
Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp
Empty the recycle bin
Boot

Run ActiveScan online virus scan

http://www.pandasoftware.com/activescan/

When the scan is finished, anything that it cannot clean have it delete it. Make a note of the file location of anything that cannot be deleted so you can delete it yourself.
- Save the results from the scan!

Post a new HiJackThis log along with the results from ActiveScan

Try Ewido again and post its log

Please give feedback on what worked/didn’t work and the current status of your system

 

[Trebliug]

On updating AboutBuster error message "An error has occured while updating"

Can't remember the error message on Msc... sorry

 

[MFDnNC]

Keep going

 

[Trebliug]

Good Morning, sorry Activescan took so long and I didn't wait and when I woke up this morning IE browser was already closed so I can't send you the log for that scan....

Norton Antivirus is still deactivated, evrything is disabled and I can't activate anything manually....

Still can't update Ewido, connection error. I'm running the scan anyway at the moment....

Logfile of HijackThis v1.99.1
Scan saved at 07:30:35, on 20/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ntyn32.exe
C:\Documents and Settings\User\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {53C9AB6D-6031-E16B-125B-94A3A319C53F} - C:\WINDOWS\system32\d3le32.dll
O2 - BHO: Class - {A8995D1C-4882-29FE-B52D-2D99FF80D879} - C:\WINDOWS\winhr32.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [ntyn32.exe] C:\WINDOWS\system32\ntyn32.exe
O4 - HKLM\..\RunOnce: [ipku.exe] C:\WINDOWS\ipku.exe
O4 - HKLM\..\RunOnce: [sdkwr32.exe] C:\WINDOWS\system32\sdkwr32.exe
O4 - HKLM\..\RunOnce: [appsw32.exe] C:\WINDOWS\appsw32.exe
O4 - HKLM\..\RunOnce: [d3rw.exe] C:\WINDOWS\d3rw.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{851CAB41-432B-42E1-9F78-D4C2D908A39F}: NameServer = 195.92.195.95 195.92.195.94
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\ntfc32.exe" /s (file missing)
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Deepsight Extractor (DeepsightExtractor) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: DeepSight Extractor Service for NPF03 (ExtractorServiceNPF03) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF03.exe
O23 - Service: DeepSight Extractor Service for NPF04 (ExtractorServiceNPF04) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF04.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

 

[Trebliug]

this is the log post Ewido scan, but without the update due to connection issues

+ Created on: 08:08:26, 20/07/2005
+ Report-Checksum: 3120D328

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{07A70617-8D17-A480-A5CF-0FCA3C65180D} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{0FBFA147-FFB4-19A8-49F8-D1A17B80E32D} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1B9CEE94-E0D7-13CF-2DA8-CA3C766EAAD0} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{1F5650BA-2C95-0E8C-5C3F-D482646BF979} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2621D1BF-0A92-2D9C-E595-02A9C3F76F46} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{3C2E0AC2-347B-07FF-761D-31083C460F98} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{497AEAF3-0F8F-A4B6-48F2-A80144D90604} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4FFB405E-2D99-7374-B6D3-F0CD9DC8744E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{595B569B-A80C-DEE4-5AE6-7AF21D2B6F17} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{67A0E5DD-D21D-3F1C-2FD5-07C50B27B4BD} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{68005AEB-2632-F033-B29F-EA21C446CA22} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8324D4AA-9FD0-5334-D040-C3B82F9A8957} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{841CB982-C366-4290-3F00-95A1A5F3C340} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8E883EC3-ABB5-0CD9-EC0A-78CB81A818D1} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{9FF47B90-35D9-6F6F-3BC1-027BAA23833E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A6BF9B01-2B57-89D9-AD1F-AF854374C992} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D27DD7B4-A72B-4B66-2BD3-262B793A3C2C} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{EA8D7DFA-04BF-99E7-595C-535DC7F0EFBA} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FBA372DA-732C-2096-07DB-AA0E71833D10} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW -> Spyware.CoolWebSearch : Cleaned with backup
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{339BB23F-A864-48C0-A59F-29EA915965EC} -> Spyware.HuntBar : Cleaned with backup
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87766247-311C-43B4-8499-3D5FEC94A183} -> Spyware.HuntBar : Cleaned with backup
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8952A998-1E7E-4716-B23D-3DBE03910972} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D7E3B41-23CE-469B-BE1B-A64B877923E1} -> Spyware.BlazeFind : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{87766247-311C-43B4-8499-3D5FEC94A183} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8952A998-1E7E-4716-B23D-3DBE03910972} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{016235BE-59D4-4CEB-ADD5-E2378282A1D9} -> Spyware.AproposMedia : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D7E3B41-23CE-469B-BE1B-A64B877923E1} -> Spyware.BlazeFind : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{339BB23F-A864-48C0-A59F-29EA915965EC} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87766247-311C-43B4-8499-3D5FEC94A183} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8952A998-1E7E-4716-B23D-3DBE03910972} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -> Spyware.ComLoad : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50} -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
HKU\S-1-5-21-1547161642-1897051121-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{339BB23F-A864-48C0-A59F-29EA915965EC} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87766247-311C-43B4-8499-3D5FEC94A183} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8952A998-1E7E-4716-B23D-3DBE03910972} -> Spyware.HuntBar : Cleaned with backup
C:\!Submit\atlax32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\!Submit\nettq.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\!Submit\ntmv.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\User\Desktop\backup\Documents and Settings\User\Cookies\[email protected][1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\User\Desktop\backups\backup-20050720-001222-797.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\Documents and Settings\User\Desktop\backups\backup-20050720-013902-629.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\5ED7814D-56D3-4094-98B0-EC4370\4D90BF43-8AEC-462B-B818-7E1744 -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\5ED7814D-56D3-4094-98B0-EC4370\DB8FEC9B-1BE2-4B3B-AB7B-2D80E1 -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\5ED7814D-56D3-4094-98B0-EC4370\ED553759-C936-462E-B192-298F39 -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\A56048AF-9019-46E8-A0E5-89C694\981DEA02-1B7A-44FA-8577-D80D2B -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\Program Files\Mqxb\Yncwofg.exe -> Trojan.Small.cy : Cleaned with backup
C:\WINDOWS\addbk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addbv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addcf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addgo.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addmc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addnp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addsl.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addxt.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addzd.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addzo.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\addzy.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apibh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apidr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apieu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apiey.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apifm.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apigt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apiis.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apikb32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apikv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apimi.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apioh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apioi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apirv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apisk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apitq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apitv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apivi.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apivu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apiww.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appcg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appcs.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apped.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appfa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appfx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apphq.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appir.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appmj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appqe32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appst32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appsw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apptz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appxi.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appyq.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appzs.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atldd.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlee32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlif.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atljo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlnc32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlnf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlvp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlxt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlzj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\autmtst.ini:bftij -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\autmtst.ini:hdotq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\autmtst.ini:hvpsz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\autmtst.ini:inmro -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\autmtst.ini:iuurp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\autmtst.ini:mglmb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\autmtst.iniazdp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\autmtst.ini:wjajf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\avrack.ini:iaqrf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\CommotionLog.txt:fxozq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CommotionLog.txt:uuahb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CommotionLog.txt:ycqpq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CommotionTest.txt:bewcm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CommotionTest.txt:kplqy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CommotionTest.txt:lpipm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\CommotionTest.txt:mquqo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\CommotionTest.txt:tqkqj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\control.ini:slhfk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\control.ini:tbnbs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\control.ini:trbqd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\crfa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crfl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crgm.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crjz.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crlq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crma32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crms32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crre32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crtg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crtq.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crua32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\cruo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crvn32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crwj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crxw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\cryi.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3ag.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3bo.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3ew32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3gq.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3hs.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3jb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3jj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3lv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3mf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3nf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3np.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3rf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3rm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3rw.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3ua.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3vq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3wx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3zm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3zq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\DEBUGSM.INI:cckie -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\DEBUGSM.INI:jbxmv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\desktop.ini:bbrcqm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\desktop.iniphdz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\EPSON Perfection 1670.ini:bjsip -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\EPSON Perfection 1670.ini:icitf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\EPSON Perfection 1670.ini:tqhge -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\fbmiz.txt:ebevo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\fbmiz.txt:krejfw -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\fbmiz.txt:ksalg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\fbmiz.txt:uuaxr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\FRONTPG.INI:ayhsq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\FRONTPG.INIkpgm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\homeDVD-Movies3.INI:awsgr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\IE4 Error Log.txt:dpxjw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\iefk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iepk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ierb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ierh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iesq.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ietj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ietp32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ieum.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iewk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iewk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iewy.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ieza32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iezx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipat32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipbl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipcc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipce.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipdu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iper32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipet32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipff32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipfh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipfx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iphh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipht32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipjh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipkm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipku.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iplz.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipmc32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipnu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipoc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipor32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ippg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipqi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipqk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipts32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipux32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipvh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipww.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipyw.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipzd.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipzg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipzt.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipzx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\JAUTOEXP.INI:lyvzo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\JAUTOEXP.INIratt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\javabd.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javabo.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaew.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javafh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javafs.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javajp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javakz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javalk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javanl.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javann32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javasu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javati.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javauk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaxf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javayv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\kyjon.txt:jvtef -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\magix.ini:techj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\maketorrent.ini:ailha -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\maketorrent.ini:axvjq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\maketorrent.inixtjq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\maketorrent.ini:szgys -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\maketorrent.ini:vfela -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\maketorrent.ini:yiymh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mdumu.txt:uxexc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\mfccl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcej32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcfk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcfq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcin.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcjz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfclr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcpf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcqj32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mfcvm.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfczi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfczk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfczv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfczw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mgxoschk.ini:euzpy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\mgxoschk.ini:jvmql -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mjttf.txt:impiet -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\ModemLog_Intel(R) 536EP V.92 Modem.txt:ajjlx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ModemLog_Intel(R) 536EP V.92 Modem.txt:bwcwd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ModemLog_Intel(R) 536EP V.92 Modem.txt:dcfwq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ModemLog_Intel(R) 536EP V.92 Modem.txt:ltwii -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ModemLog_Intel(R) 536EP V.92 Modem.txt:vneke -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ModemLog_Intel(R) 536EP V.92 Modem.txt:yyrsc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msak32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msbo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mscx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msdc32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msdfmap.ini:bjbed -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:bmpwo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\msdfmap.ini:khrkij -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msdv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msfi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msfu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msgj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msht.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msif.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msig.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mskg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msln.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mslr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mslz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msnc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msoa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msoi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msrb32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msrx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mssu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mste.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msuw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\NeroDigital.inigicv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\netck.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\neted32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netfk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netja32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netjo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netmf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netmq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netqa.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netqq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\nettq.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netud.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\netwq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\netyu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:jaccy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:npjsv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:rrvgs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:tkukgd -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:wvzae -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:xkner -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ntet32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntez32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntif.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntjy32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntka.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntnc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntpf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntre32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntxp32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntzl32.exe -> Trojan.Agent.bi : Cleaned with backup

to be continued......

 

[Trebliug]

continuation.....

:\WINDOWS\n_uiaodw.txt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBC.INI:ilrxn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBC.INIxifz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBC.INI:qfvgp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBC.INI:qswtv -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBC.INI:sxcfz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:gazxl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:lcozx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INIkqnm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:xppku -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:yiukr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\OEWABLog.txtntvb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\recorder.reg:aztqv -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\recorder.reg:vzfqo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:mhwbn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\sdkbn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkcm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkdo.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\sdkfu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkgv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkkd32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkmo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdknl.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkpr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkqz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdksh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sdkzt.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\setuplog.txt:dgwpj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\setuplog.txt:jxocg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\setuplog.txtmtez -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\sgtdo.txt:iqwmy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\sgtdo.txt:vflwu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\sgtdo.txt:ykpfa -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\snpstd.ini:atuzx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\snpstd.ini:konux -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\snpstd.inimytt -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\snpstd.src:alrth -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\snpstd.src:kuiln -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\snpstd.srcqisy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Spy Sweeper 4.0.x FIX Setup Log.txt:gujyd -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Spy Sweeper 4.0.x FIX Setup Log.txtvdup -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Spy Sweeper 4.0.x FIX Setup Log.txt:yuqfi -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\sysbz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysim32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syslj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysmc32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysph.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\syspx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysqj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\sysrz.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system.ini:dnyok -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system.ini:eaaef -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system.ini:lwylc -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system.ini:mpfbb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\addan32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addbn32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addbp32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addcg.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addcg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addfc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addhb32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addjs32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\addlm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addmn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addof.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addoo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addpv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addrq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addtg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addvg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addwd.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addwy32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addyl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\addzv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apiac32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apial.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apicc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apics.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apieb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apigk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apigr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apiib32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apijk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apijt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apilz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apiou.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apisa.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apiun32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apius.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apivo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apiwo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apiyb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apizv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appew32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apphe32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apphr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appjv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appkh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appmj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appnv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\apppd.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appsk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appxl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlap.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlas32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlcv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlcy32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atldv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlez32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlfl.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlgh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlhx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlle32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlnh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlsg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlsh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlsw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlyf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlyh32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\atlyh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlyt.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crbx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crbx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crdm.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\cres32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crgm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crnb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\croc32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\croj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crpe32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crqr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crri.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crrt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crru.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crsu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crvh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\cryv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3au32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3bf32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3bw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3cr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3fj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3ij32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3kj32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3le32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\d3lx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3mb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3mg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3oa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3pu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3ri.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3sn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3uo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3vs32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3wn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3xx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ehwyg.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\iebv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ieby32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iecz.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iedp32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iefg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iegd.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iehm32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iekp32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ielt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ielz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iemw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iets.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ietw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ieuk.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ievl32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\iezf.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\iezp32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipac32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipcv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipff.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipii.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipml32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipnp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipoa32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipob32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipqi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipqu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipuu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipws.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipyr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javaba.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javacg.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javadp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javads32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javaku32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javami.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javapu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javaqp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javaqw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javarg32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javavi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javavs32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javavx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\mfcaa32.exe -> Trojan.Agent.bi : Cleaned with backup

 

[MFDnNC]

Download CWShredder http://www.intermute.com/products/cwshredder.html

Close all browser windows,
Open cwshredder.exe then click "Fix" and let it run.

DL http://forums.techguy.org/attachment.php?attachmentid=45240

Fix these with HJT – mark them, close IE, click fix checked

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ehwyg.dll/sp.html#44768

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {53C9AB6D-6031-E16B-125B-94A3A319C53F} - C:\WINDOWS\system32\d3le32.dll

O2 - BHO: Class - {A8995D1C-4882-29FE-B52D-2D99FF80D879} - C:\WINDOWS\winhr32.dll

O4 - HKLM\..\Run: [ntyn32.exe] C:\WINDOWS\system32\ntyn32.exe

O4 - HKLM\..\RunOnce: [ipku.exe] C:\WINDOWS\ipku.exe

O4 - HKLM\..\RunOnce: [sdkwr32.exe] C:\WINDOWS\system32\sdkwr32.exe

O4 - HKLM\..\RunOnce: [appsw32.exe] C:\WINDOWS\appsw32.exe

O4 - HKLM\..\RunOnce: [d3rw.exe] C:\WINDOWS\d3rw.exe

O23 - Service: Network Security Service ( 11Fßä #·ºÄÖ`I) - Unknown owner - C:\WINDOWS\ntfc32.exe" /s (file missing)


Click Start > Run > and type in:

services.msc

Click OK.

In the services window find

Network Security Service

Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. File-Exit the Services utility.

Note: You may get an error here when trying to access the properties of the service. If you do get an error, just select the service and look there in the top left of the main service window and click "Stop" to stop the service. If that gives an error or it is already stopped, just skip this step and proceed with the rest.

Double-click the cwsserviceremove.reg file you downloaded at the beginning.
Answer Yes when prompted to add the contents to the registry.



DL http://www.downloads.subratam.org/KillBox.zip

Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\WINDOWS\system32\ehwyg.dll
C:\WINDOWS\system32\d3le32.dll
C:\WINDOWS\winhr32.dll
C:\WINDOWS\system32\ntyn32.exe
C:\WINDOWS\ipku.exe
C:\WINDOWS\system32\sdkwr32.exe
C:\WINDOWS\appsw32.exe
C:\WINDOWS\d3rw.exe


Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

Exit the Killbox.


START – RUN – type in %temp% OK - Edit – Select all – File – Delete
Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp
Empty the recycle bin
Boot

Run the active scan again, try updating Ewido now

Post all of the logs

Please give feedback on what worked/didn’t work and the current status of your system

 

[Trebliug]

still doesn't work, can't update windows

 

[MFDnNC]

Post the new log

 

[Trebliug]

sorry, still doesn't work...... can't update windows, Norton antivirus still not working as well.... I am reall, really stuck here. Anyway, following are log from Ewido, but i can't save Activesacan (browser closes down right after the scan).

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 20:57:54, 24/07/2005
+ Report-Checksum: 9DA5B6B7

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{491288EB-D314-5571-9C18-B1EAC89ADE09} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW -> Spyware.CoolWebSearch : Cleaned with backup
C:\WINDOWS\addpy.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\addxe.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apicn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apieg.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\appcc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appuu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlbr32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\atlij32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\atlir32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlyc32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\crhf32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\desktop.ini:jmspp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\iegr32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\iemh.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ient.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iert32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\javaip32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\javaqe32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\mfcmz.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mgxoschk.ini:jvmql -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\netfq.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\netqh32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ntbtlog.txt:hofvj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\sdkwe32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\Spy Sweeper 4.0.x FIX Setup Log.txt:aylip -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\Spy Sweeper 4.0.x FIX Setup Log.txt:hyvnz -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\sysnd32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system.ini:nmxnt -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\addad.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\apimh.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\apivr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atlwt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crbc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3mc32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\iprp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\ipyo32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\mfchr32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\msav32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\msfx32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\mspn32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\msyq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\netjv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\netzf32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\ntor.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\nttg32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\sdkhx32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\sdkzv32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\sysfg.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\winaq.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\winvj.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\winzc.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\ycixm.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\syszh.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\vb.ini:nniurw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\vbaddin.ini:roslk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winbl.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winrp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\wkiea.txtpkoy -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_default.pif:anegw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:fyjna -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:gcagb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:gcduf -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:gcggj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:gdbcx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:ghopj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:gimvh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:gpram -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hahqo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hblbj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hbtax -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:heumu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hewqr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hhuuk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hickq -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hjbnu -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hjfsu -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hkktf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hkyuk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hltpwg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hrvqd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:htyfi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hukyj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:hzapr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:icfit -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:icfpg -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:idprw -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:ifqbl -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:iijpd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:iofur -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:isryx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:ituth -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:iutit -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:iuuau -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:iyefh -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jbmws -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jbpgf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jbykm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jddyx -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jdezr -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jhxwm -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jjais -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jkvur -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jmyqy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jpyxyi -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jqruo -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:jwwzj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kbcfy -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kbsus -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kcusn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kdicq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kdqjp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:keicx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kejjq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:keymup -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kfpmn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kgdwj -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:khhdf -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:khomq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:khrgh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kmtbq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kpmbsg -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kpyzm -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kqpsya -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kqxau -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:ktoyr -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:ktqgc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kutdd -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kwghp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kxjqi -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kxtul -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:kzpsg -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:laqda -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:lduld -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:levaj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:lgqoj -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:lhbun -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_ISRES.DLL:liund -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:acdzk -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:afkbo -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:dphrs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:eaemps -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:enaxe -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:fnkfxb -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:hzafgh -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:kpbmz -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:lhnuk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dllmqwe -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dllplqa -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:sntpa -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\__delete_on_reboot__winhr32.dll:uztgri -> TrojanDownloader.Agent.bc : Cleaned with backup


::Report End

 

[Trebliug]

And heres the last log from HJT, just in case.... Thank you.

Logfile of HijackThis v1.99.1
Scan saved at 21:09:32, on 24/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\addur32.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\User\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\blmhs.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\blmhs.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\blmhs.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\blmhs.dll/sp.html#44768
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\blmhs.dll/sp.html#44768
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\blmhs.dll/sp.html#44768
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\blmhs.dll/sp.html#44768
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {1DFB1F0E-E4FA-9122-10FB-11AD977CE8D6} - C:\WINDOWS\system32\ipsg32.dll
O2 - BHO: Class - {450A0139-EE98-149B-D4CA-65522E7424A7} - C:\WINDOWS\atlqo32.dll
O2 - BHO: Class - {8F7588D6-7A8B-1766-6205-203FDF6F7347} - C:\WINDOWS\system32\nttg32.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [addur32.exe] C:\WINDOWS\addur32.exe
O4 - HKLM\..\RunOnce: [ieqa32.exe] C:\WINDOWS\ieqa32.exe
O4 - HKLM\..\RunOnce: [msyq32.exe] C:\WINDOWS\system32\msyq32.exe
O4 - HKLM\..\RunOnce: [sdkzv32.exe] C:\WINDOWS\system32\sdkzv32.exe
O4 - HKLM\..\RunOnce: [appuu32.exe] C:\WINDOWS\appuu32.exe
O4 - HKLM\..\RunOnce: [javaip32.exe] C:\WINDOWS\javaip32.exe
O4 - HKLM\..\RunOnce: [atlwt32.exe] C:\WINDOWS\system32\atlwt32.exe
O4 - HKLM\..\RunOnce: [mspn32.exe] C:\WINDOWS\system32\mspn32.exe
O4 - HKLM\..\RunOnce: [iemh.exe] C:\WINDOWS\iemh.exe
O4 - HKLM\..\RunOnce: [appcc.exe] C:\WINDOWS\appcc.exe
O4 - HKLM\..\RunOnce: [atlir32.exe] C:\WINDOWS\atlir32.exe
O4 - HKLM\..\RunOnce: [ient.exe] C:\WINDOWS\ient.exe
O4 - HKLM\..\RunOnce: [Panda_cleaner_189653] C:\WINDOWS\system32\ActiveScan\pavdr.exe 189653
O4 - HKLM\..\RunOnce: [sysnd32.exe] C:\WINDOWS\sysnd32.exe
O4 - HKLM\..\RunOnce: [netqh32.exe] C:\WINDOWS\netqh32.exe
O4 - HKLM\..\RunOnce: [winvj.exe] C:\WINDOWS\system32\winvj.exe
O4 - HKLM\..\RunOnce: [apicn.exe] C:\WINDOWS\apicn.exe
O4 - HKLM\..\RunOnce: [sdkhx32.exe] C:\WINDOWS\system32\sdkhx32.exe
O4 - HKLM\..\RunOnce: [mfcmz.exe] C:\WINDOWS\mfcmz.exe
O4 - HKLM\..\RunOnce: [ntor.exe] C:\WINDOWS\system32\ntor.exe
O4 - HKLM\..\RunOnce: [apput32.exe] C:\WINDOWS\apput32.exe
O4 - HKLM\..\RunOnce: [javaqe.exe] C:\WINDOWS\system32\javaqe.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{851CAB41-432B-42E1-9F78-D4C2D908A39F}: NameServer = 195.92.195.95 195.92.195.94
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\ieqa32.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Deepsight Extractor (DeepsightExtractor) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: DeepSight Extractor Service for NPF03 (ExtractorServiceNPF03) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF03.exe
O23 - Service: DeepSight Extractor Service for NPF04 (ExtractorServiceNPF04) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorServiceNPF04.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe