Winik.sys..can't remove the little bleeder!, Malware Options

[MoANjAm]

Dear Gang,

Please could you give some advice for removing winik.sys? I use Firefox and DeepNet but used to use IE6 where i probably downloaded this from.

IE6 will crash after a short time and also browsing can take ages. AVG free V7 detcs winik.sys but cannot heal

Root drive is \E: and not \C: btw!

many thanks

Mo

###########################
Logfile of HijackThis v1.99.1
Scan saved at 10:06:56, on 28/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\PROGRA~1\COMMON~2\ADDRES~1\Winnet.exe
E:\PROGRA~1\wpvturwp\GIgDGgBL.exe
E:\PROGRA~1\COMMON~2\ADDRES~1\comwiz.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\QuickTime\qttask.exe
E:\PROGRA~1\wpvturwp\LBgGDgIG.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Program Files\WinZip\WZQKPICK.EXE
E:\Program Files\Microsoft Office\Office\OSA.EXE
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\Deepnet Explorer\Deepnet.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgvv.exe
E:\Program Files\Microsoft Office\Office\Winword.exe
E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
E:\Program Files\NavExcel\NavHelper\v2.0.4d\NHUpdater.exe
E:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - E:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NavHelper Class - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} - E:\Program Files\NavExcel\NavHelper\v2.0.4d\NHelper.dll
O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - E:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll
O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - E:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [navapp] E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [winnet] E:\PROGRA~1\COMMON~2\ADDRES~1\Winnet.exe
O4 - HKLM\..\Run: [Zenet] rundll32.exe E:\PROGRA~1\COMMON~2\Toolbar\CNBabe.dll,DllStartup
O4 - Startup: Office Startup.lnk = E:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Exif Launcher.lnk = E:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = E:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add A Page Note - E:\Program Files\CommonName\AddressBar\createnote.htm
O8 - Extra context menu item: Bookmark This Page - E:\Program Files\CommonName\AddressBar\createbookmark.htm
O8 - Extra context menu item: Email This Link - E:\Program Files\CommonName\AddressBar\emaillink.htm
O8 - Extra context menu item: Search using CommonName - E:\Program Files\CommonName\AddressBar\navigate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by CommonName
O10 - Hijacked Internet access by CommonName
O10 - Hijacked Internet access by CommonName
O10 - Hijacked Internet access by CommonName
O11 - Options group: [CommonName] CommonName
O12 - Plugin for .mpg: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O15 - Trusted Zone: *.line6.net
O18 - Protocol hijack: cn - {9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40}
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: V2i Protector - PowerQuest Corporation - E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

####################################
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "winik" 28/01/2006 10:17:21

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000\Control]
"ActiveService"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK]
"DisplayName"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum]
"0"="Root\\LEGACY_WINIK\\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK]
"DisplayName"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinIK\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000\Control]
"ActiveService"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK]
"DisplayName"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum]
"0"="Root\\LEGACY_WINIK\\0000"

#####################################
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 28/01/2006 10:19 80 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RY0HYgow 15/12/2005 10:39 68 bytes Hidden from Windows API.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed 28/01/2006 10:17 4 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesSuccessful 28/01/2006 10:17 4 bytes Data mismatch between Windows API and raw hive data.
E:\Documents and Settings\John\Recent\Off!© 22/08/2005 15:54 281 bytes Visible in Windows API, but not in MFT or directory index.
E:\Documents and Settings\John\Recent\serial.txt (2).lnk 24/06/2005 19:37 904 bytes Visible in Windows API, but not in MFT or directory index.
E:\Documents and Settings\John\Recent\startuplist.txt.lnk 28/01/2006 10:24 711 bytes Hidden from Windows API.
E:\Program Files\Hijackthis\hijackthis1.log 28/01/2006 10:08 5.27 KB Visible in Windows API, but not in MFT or directory index.
E:\Program Files\Hijackthis\startuplist.txt 28/01/2006 10:24 30.98 KB Hidden from Windows API.
E:\RECYCLER\S-1-5-21-1343024091-1532298954-682003330-1003\De9.log 28/01/2006 10:08 5.27 KB Hidden from Windows API.
E:\System Volume Information\_restore{D3D2BE83-E0A6-47AA-9AA7-C5B70CAA9D97}\RP135\A0011315.lnk 22/08/2005 16:54 281 bytes Hidden from Windows API.
E:\System Volume Information\_restore{D3D2BE83-E0A6-47AA-9AA7-C5B70CAA9D97}\RP135\A0011316.lnk 24/06/2005 20:37 904 bytes Hidden from Windows API.
#####################################

StartupList report, 28/01/2006, 10:24:15
StartupList version: 1.52.2
Started from : E:\Program Files\Hijackthis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\PROGRA~1\COMMON~2\ADDRES~1\Winnet.exe
E:\PROGRA~1\wpvturwp\GIgDGgBL.exe
E:\PROGRA~1\COMMON~2\ADDRES~1\comwiz.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\QuickTime\qttask.exe
E:\PROGRA~1\wpvturwp\LBgGDgIG.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Program Files\WinZip\WZQKPICK.EXE
E:\Program Files\Microsoft Office\Office\OSA.EXE
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\Deepnet Explorer\Deepnet.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgvv.exe
E:\Program Files\Microsoft Office\Office\Winword.exe
E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
E:\Documents and Settings\John\Desktop\Malware\rootkitrevealer\RootkitRevealer.exe
E:\DOCUME~1\John\LOCALS~1\Temp\PFHTXFJMU.exe
E:\Program Files\Hijackthis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[E:\Documents and Settings\John\Start Menu\Programs\Startup]
Office Startup.lnk = E:\Program Files\Microsoft Office\Office\OSA.EXE

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[E:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Exif Launcher.lnk = E:\Program Files\FinePixViewer\QuickDCF.exe
InterVideo WinCinema Manager.lnk = E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
WinZip Quick Pick.lnk = E:\Program Files\WinZip\WZQKPICK.EXE

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = E:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NeroCheck = E:\WINDOWS\system32\NeroCheck.exe
SunJavaUpdateSched = E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
AVG7_CC = E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
AVG7_EMC = E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
navapp = E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
winnet = E:\PROGRA~1\COMMON~2\ADDRES~1\Winnet.exe
Zenet = rundll32.exe E:\PROGRA~1\COMMON~2\Toolbar\CNBabe.dll,DllStartup

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = E:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = E:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection E:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection E:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection E:\WINDOWS\INF\wmp10.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = E:\WINDOWS\system32\Rundll32.exe E:\WINDOWS\system32\mscories.dll,Install

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from E:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from E:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=E:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

E:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
E:\WINDOWS\Explorer\Explorer.exe: not present
E:\WINDOWS\System\Explorer.exe: not present
E:\WINDOWS\System32\Explorer.exe: not present
E:\WINDOWS\Command\Explorer.exe: not present
E:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in E:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

BabeIE - E:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll - {00000000-0000-0000-0000-000000000000}
(no name) - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - E:\Program Files\NavExcel\NavHelper\v2.0.4d\NHelper.dll - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}
(no name) - E:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll - {D80C4E21-C346-4E21-8E64-20746AA20AEB}

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Download Program Files:

[QuickTime Object]
InProcServer32 = E:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave Flash Object]
InProcServer32 = E:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: E:\WINDOWS\System32\mswsock.dll
NameSpace #2: E:\WINDOWS\System32\winrnr.dll
NameSpace #3: E:\WINDOWS\System32\mswsock.dll
Protocol #1: E:\PROGRA~1\COMMON~2\Toolbar\CNMib.dll
Protocol #2: E:\PROGRA~1\COMMON~2\Toolbar\CNMib.dll
Protocol #3: E:\PROGRA~1\COMMON~2\Toolbar\CNMib.dll
Protocol #4: E:\WINDOWS\system32\mswsock.dll
Protocol #5: E:\WINDOWS\system32\mswsock.dll
Protocol #6: E:\WINDOWS\system32\mswsock.dll
Protocol #7: E:\WINDOWS\system32\rsvpsp.dll
Protocol #8: E:\WINDOWS\system32\rsvpsp.dll
Protocol #9: E:\WINDOWS\system32\mswsock.dll
Protocol #10: E:\WINDOWS\system32\mswsock.dll
Protocol #11: E:\WINDOWS\system32\mswsock.dll
Protocol #12: E:\WINDOWS\system32\mswsock.dll
Protocol #13: E:\WINDOWS\system32\mswsock.dll
Protocol #14: E:\WINDOWS\system32\mswsock.dll
Protocol #15: E:\WINDOWS\system32\mswsock.dll
Protocol #16: E:\WINDOWS\system32\mswsock.dll
Protocol #17: E:\PROGRA~1\COMMON~2\Toolbar\CNMib.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
aeaudio: system32\drivers\aeaudio.sys (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: system32\DRIVERS\agp440.sys (system)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
1394 ARP Client Protocol: system32\DRIVERS\arp1394.sys (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
ati2mtag: system32\DRIVERS\ati2mtag.sys (manual start)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
AVG7 Alert Manager Server: E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe (autostart)
AVG7 Kernel: \SystemRoot\System32\Drivers\avg7core.sys (system)
AVG7 Wrap Driver: \SystemRoot\System32\Drivers\avg7rsw.sys (system)
AVG7 Rezident Driver: \SystemRoot\System32\Drivers\avg7rsxp.sys (system)
AVG7 Update Service: E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe (autostart)
AVG Network Redirector: \??\E:\WINDOWS\System32\Drivers\avgtdi.sys (autostart)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (disabled)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
COM+ System Application: E:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
Service for Delta Driver (WDM): system32\drivers\delta.sys (manual start)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Logical Disk Manager Driver: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
3Com 3C2000x EtherLink XL Adapter: system32\DRIVERS\EL2K_XP.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: E:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: system32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: system32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\DRIVERS\fltMgr.sys (system)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Service for L6 GuitarPort Driver (WDM): System32\Drivers\GPWADrv.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
InstallDriver Table Manager: "E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: E:\WINDOWS\system32\imapi.exe (manual start)
IntelIde: system32\DRIVERS\intelide.sys (system)
Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\DRIVERS\Ip6Fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
L6DP: System32\Drivers\l6dp.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
MidiSyn: system32\drivers\MidiSyn.sys (manual start)
NetMeeting Remote Desktop Sharing: E:\WINDOWS\system32\mnmsrvc.exe (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: E:\WINDOWS\system32\msdtc.exe (manual start)
Windows Installer: E:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
1394 Net Driver: system32\DRIVERS\nic1394.sys (manual start)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
VIA OHCI Compliant IEEE 1394 Host Controller: system32\DRIVERS\ohci1394.sys (system)
Parallel port driver: system32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
PFHTXFJMU: E:\DOCUME~1\John\LOCALS~1\Temp\PFHTXFJMU.exe (manual start)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: system32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: E:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start)
Serial port driver: system32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
smwdm: system32\drivers\smwdm.sys (manual start)
Raw Socket Lock Driver: \??\E:\WINDOWS\system32\socketlock.sys (autostart)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (manual start)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: E:\WINDOWS\system32\dllhost.exe /Processid:{E90A10A5-46EF-4B64-A11B-EBDA664ACD06} (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Telnet: E:\WINDOWS\system32\tlntsvr.exe (disabled)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework: E:\WINDOWS\system32\wdfmgr.exe (autostart)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: system32\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start)
V2i Protector: E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe (autostart)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
vsdatant: System32\vsdatant.sys (system)
TrueVector Internet Monitor: E:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
WinIK: System32\Drivers\WinIK.sys (system)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: E:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: E:\WINDOWS\system32\SHELL32.dll
CDBurn: E:\WINDOWS\system32\SHELL32.dll
WebCheck: E:\WINDOWS\system32\webcheck.dll
SysTray: E:\WINDOWS\system32\stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 32,458 bytes
Report generated in 0.218 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
####################################
"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NeroCheck" = "E:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"SunJavaUpdateSched" = "E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"AVG7_CC" = "E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
"AVG7_EMC" = "E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
"navapp" = "E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe" [null data]
"winnet" = "E:\PROGRA~1\COMMON~2\ADDRES~1\Winnet.exe" ["CommonName"]
"Zenet" = "rundll32.exe E:\PROGRA~1\COMMON~2\Toolbar\CNBabe.dll,DllStartup" [MS]
"(Default)" = """ = (data in unrecognized format!)" [file not found]
"RIpGR9Uw" = "E:\PROGRA~1\wpvturwp\GIgDGgBL.exe" [null data]
"TkBellExe" = ""E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"RAVHUoUw" = "E:\PROGRA~1\wpvturwp\GIgDGgBL.exe" [null data]
"QuickTime Task" = ""E:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"YUpGY11w" = "E:\PROGRA~1\wpvturwp\GIgDGgBL.exe" [null data]
"Zone Labs Client" = "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"]
"RMVGY1ov" = "E:\PROGRA~1\wpvturwp\GIgDGgBL.exe" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{00000000-0000-0000-0000-000000000000}\(Default) = "BabeIE"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll" ["CommonName"]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}\(Default) = "NavHelper Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\NavExcel\NavHelper\v2.0.4d\NHelper.dll" ["NavExcel"]
{D80C4E21-C346-4E21-8E64-20746AA20AEB}\(Default) = "Helper Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\Audiodev.dll" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{043308A2-3CF7-4ED5-A668-2B4FB0BD307A}" = "dBpowerAMP dAP Scripting"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Illustrate\dBpowerAMP\dBScripting.dll" ["Illustrate"]
"{FED7043D-346A-414D-ACD7-550D052499A7}" = "dBpowerAMP Popup Info"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Illustrate\dBpowerAMP\dBShell.dll" [empty string]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\browseui.dll" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "E:\Documents and Settings\John\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "E:\WINDOWS\System32\logon.scr" [MS]


Startup items in "John" & "All Users" startup folders:
------------------------------------------------------

E:\Documents and Settings\John\Start Menu\Programs\Startup
"Office Startup" -> shortcut to: "E:\Program Files\Microsoft Office\Office\OSA.EXE -b" [MS]

E:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Exif Launcher" -> shortcut to: "E:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]
"InterVideo WinCinema Manager" -> shortcut to: "E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe" [empty string]
"WinZip Quick Pick" -> shortcut to: "E:\Program Files\WinZip\WZQKPICK.EXE" ["WinZip Computing, Inc."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [

[Mosaic1]

Download WinSockFix from here:

http://www.softpedia.com/get/Tweak/Network...inSockFix.shtml

If you have any trouble connecting to theinternet after you have finished wiuth these directions. then run the Winsockfix you downloaded.





You will be restarting into Safe mode later. Here's help if you need it.

To use the F8 key to start Windows XP in Safe mode
Restart the computer.
Some computers have a progress bar that refers to the word BIOS. Others may not let you know what is happening.
As soon as the BIOS loads, begin tapping the F8 key on your keyboard. Do so until the Windows Advanced Options menu appears.
If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. If this happens, restart the computer and try again.
Using the arrow keys on the keyboard, select Safe mode and then press Enter.

----------------------------


Please download, install, and update the free version of Ewido trojan scanner:
http://www.ewido.net/en/download/


When you run ewido for the first time, you might get a warning "Database could not be found!". Click OK.

From the main ewido screen, click on update in the left menu, then click the Start update button.

After the update finishes (the status bar at the bottom will display "Update successful")

Exit Ewido. DO NOT scan yet.


If you are having problems with the updater, you can go to http://www.ewido.net/en/download/updates/ to update manually
-----------------


You may want to copy these directions to notepad for easy reference.

----------------------------

Copy the contents of the code box to Notepad.
Name the file go.bat
Save as Type: All files

CODE

Echo REGEDIT4>step1.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] >>step1.reg

regedit /a /e /s  step2.reg HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Copy step1.reg + step2.reg %SystemDrive%\step3.reg


Reg Add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ugly
Reg Save  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ugly ugly.hiv

Reg Restore HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK ugly.hiv

Reg Delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ugly /f

del step1.reg
del step2.reg

Sign off the internet.

Double click on go.bat and let it run.

Immediately restart into Safe mode.
Go to Start >Run and paste in this command. Then press enter:

%SystemDrive%\step3.reg

Say yes to the prompt.

==================

Delete this file:
E:\windows\system32\drivers\winik.sys

Delete this folder:
E:\PROGRAM FILES\wpvturwp

-------------

Next, run a scan with Ewido.

Click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run, so please be patient

If Ewido finds anything, it will pop up a notification. You can select "remove" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.

When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Copy and paste the results from that scan back here when you return to post again.








Restart into regular windows.

Run hijackthis and post the new log.

Post a new Startuplist log.

Post the EWIDO log.

b]You may have to reply more than once to fit all the logs into your response. Please be sure the entire contents of all logs is showing in your reponses. Thank you. [/b]

We'll have some cleanup to do still.

---------------
Run Hijackthis.
Press the Config Button.

Press the Misc Tools Button.
Press the Open Uninstall Manager Button.

Click the Save list Button.

Save the file to your desktop. Copy and paste the contents into your next reply here, please.

[MoANjAm]

Mosaic1,

cheers buddy - you are a star. thanks for your quick reply.

ok here are the results -

First the Ewido log;

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 18:54:33, 29/01/2006
+ Report-Checksum: 48B00E54

+ Scan result:

HKLM\SOFTWARE\Classes\AppID\winnet.EXE -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\AppID\{118A2BFA-5AC7-4D29-BEB9-D68F4D2CCCAB} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.AgentIE -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.AgentIE\CLSID -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.AgentIE\CurVer -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.AgentIE.1 -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Handler -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Handler\CLSID -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Handler\CurVer -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Handler.1 -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Helper -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Helper\CLSID -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Helper\CurVer -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\BabeIE.Helper.1 -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2EB3EFF2-F707-4EA8-81AA-4B65D2799F31} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{5AA06644-BC46-4220-A460-47A6EB47C96D} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6656b666-992f-4d74-8588-8ca69e97d90c} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{D80C4E21-C346-4E21-8E64-20746AA20AEB} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{20F36AF3-3486-4BB6-8BCB-F1F8ABE74D07} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{2D0F5208-3198-49A4-86A7-D65E9E582751} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{4D6CED50-D6AE-40DA-B87F-235593FC1F28} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{8ADBBE3E-1841-4708-85DF-727CCEE6220B} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{99908473-1135-4009-BE4F-32B921F86ED9} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\NavExcel.NavHelper -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\NavExcel.NavHelper\CLSID -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\NavExcel.NavHelper\CurVer -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\NavExcel.NavHelper.1 -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\cn -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{209B1CEA-8B2E-4596-9B35-A4A7DB611EB2} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{CC364A32-D59B-4E9C-9156-F0050C45005B} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{D879D743-E2CC-4161-8034-2234203681C9} -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{FA4DE133-D3C3-4ED4-92D1-CD4DDE839AB3} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Classes\Winnet.Update -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Winnet.Update\CLSID -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Winnet.Update\CurVer -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Classes\Winnet.Update.1 -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\CommonName -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\CommonName\BabeIE -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\CommonName\User -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CommonName -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CommonName\BrowserAgent -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CommonName\HttpError -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CommonName\ResolveBookmarkName -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CommonName\ResolveIntranetName -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CommonName\Tooltip -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{5AA06644-BC46-4220-A460-47A6EB47C96D} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D80C4E21-C346-4E21-8E64-20746AA20AEB} -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CommonName -> Spyware.CommonName : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NavExcel Search Toolbar -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NavHelper -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\NavExcel -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\NavExcel\NavHelper -> Spyware.NavExcel : Cleaned with backup
HKLM\SOFTWARE\NavExcel\NavHelper\v2.0.4d -> Spyware.NavExcel : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Services\WinIK -> Spyware.CommonName : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Services\WinIK\Enum -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\CommonName -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\CommonName\AgentIE -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\CommonName\BabeIE -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\CommonName\User -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Internet Explorer\MenuExt\Add A Page Note -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Internet Explorer\MenuExt\Bookmark This Page -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Internet Explorer\MenuExt\Email This Link -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Internet Explorer\MenuExt\Search using CommonName -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5AA06644-BC46-4220-A460-47A6EB47C96D} -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6656B666-992F-4D74-8588-8CA69E97D90C} -> Spyware.CommonName : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D80C4E21-C346-4E21-8E64-20746AA20AEB} -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd\NavExcel Search Toolbar -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd\NavExcel Search Toolbar\History -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd\NavExcel Search Toolbar\System -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd\NavExcel Search Toolbar\System\CurrentControlSet -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd\NavExcel Search Toolbar\System\CurrentControlSet\Services -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd\NavExcel Search Toolbar\System\CurrentControlSet\Services\Tcpip -> Spyware.NavExcel : Cleaned with backup
HKU\S-1-5-21-1343024091-1532298954-682003330-1003\Software\NavExcel Ltd\NavExcel Search Toolbar\System\CurrentControlSet\Services\Tcpip\Parameters -> Spyware.NavExcel : Cleaned with backup
D:\Documents and Settings\Admin\Cookies\admin@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Documents and Settings\Admin\Cookies\admin@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
D:\Documents and Settings\Admin\Cookies\admin@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
D:\Documents and Settings\Admin\Cookies\admin@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Documents and Settings\Admin\Cookies\admin@servedby.advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Documents and Settings\Admin\Local Settings\Temp\djtopr1150.exe -> Spyware.WebRebates.g : Cleaned with backup
D:\Documents and Settings\Admin\Local Settings\Temp\jkill.exe -> Spyware.VX2 : Cleaned with backup
D:\Documents and Settings\Admin\re11.REG -> Trojan.LowZones.a : Cleaned with backup
D:\Program Files\BullsEye Network\bin\bargains.exe -> Spyware.BargainBuddy : Cleaned with backup
D:\Program Files\Web_Rebates\disp1150.exe -> Spyware.WebRebates : Cleaned with backup
D:\Program Files\Web_Rebates\Sy1150\Sy1150\1150_1.dat -> Spyware.TopMoxie : Cleaned with backup
D:\Program Files\Winad Client\ClientCom.dll -> Spyware.WinAD : Cleaned with backup
D:\RECYCLER\S-1-5-21-1343024091-1532298954-682003330-1003\Dd1.tmp\preInsTT.exe -> Spyware.BiSpy : Cleaned with backup
D:\RECYCLER\S-1-5-21-1343024091-1532298954-682003330-1003\Dd1.tmp\twaintec.dll -> Spyware.BiSpy : Cleaned with backup
D:\temp\FLEOK\msbb.exe -> Spyware.180Solutions : Cleaned with backup
:mozilla.19:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.20:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.21:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.22:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.23:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Trafic : Cleaned with backup
:mozilla.25:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.26:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.27:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.28:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.29:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.38:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.53:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.57:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.70:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.71:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.74:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.77:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Etracker : Cleaned with backup
:mozilla.90:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.91:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.94:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.98:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.103:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.121:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.122:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.124:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.135:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.136:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.137:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.138:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.139:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.148:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.154:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.155:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.156:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.157:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.167:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.178:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.179:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.180:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.181:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.182:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.183:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.184:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Pro-market : Cleaned with backup
:mozilla.220:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.221:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.222:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.223:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.228:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.233:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.243:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.244:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.245:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.250:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.251:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.252:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.253:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.296:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.300:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.301:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.332:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.334:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.335:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.336:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.341:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.342:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.343:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.344:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.345:E:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\9irni9xm.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@ads.pointroll[2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@adviva[2].txt -> Spyware.Cookie.Adviva : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@as1.falkag[1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@casalemedia[2].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@e-2dj6wjnyogc5oeo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@ehg-eline.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@ehg-iwantoneofthose.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@ehg-marshalls.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@linksynergy[1].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@server.lon.liveperson[2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@-- The nicest hobby on Earth ;) --list[1].txt -> Spyware.Cookie.-- The nicest hobby on Earth ;) --list : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@www.smartadserver[1].txt -> Spyware.Cookie.Smartadserver : Cleaned with backup
E:\Documents and Settings\John\Cookies\john@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
E:\Program Files\CommonName -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\babe.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\cnbabe.dll -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\Comwiz.exe -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\createbookmark.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\createnote.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\dfs.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\emaillink.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\exit.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\fws.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\ikw.exe -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\navigate.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\obj.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\rws.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\unins.exe -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\url2.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\url8.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\url9.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\AddressBar\Winnet.exe -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\babe.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\CNBabe.dll -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\cnbabeie.exe -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\CNMib.dll -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\createbookmark.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\createnote.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\emaillink.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\mib.dat -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\navigate.htm -> Adware.CommonName : Cleaned with backup
E:\Program Files\CommonName\Toolbar\unins.exe -> Adware.CommonName : Cleaned with backup
E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe -> Spyware.NavExcel : Cleaned with backup
E:\Program Files\NavExcel\NavHelper\v2.0.4d\NHelper.dll -> Spyware.NavExcel : Cleaned with backup
E:\Program Files\NavExcel\NavHelper\v2.0.4d\NHUninstaller.exe -> Spyware.NavExcel : Cleaned with backup
E:\Program Files\NavExcel\NavHelper\v2.0.4d\v2.0.4d.cab/NHelper.dll -> Spyware.NavExcel : Cleaned with backup
E:\Program Files\NavExcel\NavHelper\v2.0.4d\v2.0.4d.cab/NHUninstaller.exe -> Spyware.NavExcel : Cleaned with backup
E:\Program Files\NavExcel\NavHelper\v2.0.4d\v2.0.4d.cab/navapp.exe -> Spyware.NavExcel : Cleaned with backup
E:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll -> Adware.NavExcel : Cleaned with backup
E:\WINDOWS\nxstinst.exe -> Spyware.NavExcel : Cleaned with backup
E:\WINDOWS\remover.dll -> Spyware.NavExcel : Cleaned with backup
G:\Cabinet\John\Funnies\Wibble.exe -> Trojan.Win16.Bearded : Cleaned with backup
H:\2b34.exe/re11.REG -> Trojan.LowZones.a : Cleaned with backup
H:\32d34.exe -> Trojan.LowZones.p : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@-1shz2prbmdj6wvny-1sez2pra2dj6wjl4eldpofqa-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@adtech[1].txt -> Spyware.Cookie.Adtech : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@adviva[1].txt -> Spyware.Cookie.Adviva : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@c.porngraph[1].txt -> Spyware.Cookie.Porngraph : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@ehg-tmgolf.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@estat[1].txt -> Spyware.Cookie.Estat : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@gator[2].txt -> Spyware.Cookie.Gator : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@hotlog[2].txt -> Spyware.Cookie.Hotlog : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@-- The nicest hobby on Earth ;) --list[1].txt -> Spyware.Cookie.-- The nicest hobby on Earth ;) --list : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@weborama[1].txt -> Spyware.Cookie.Weborama : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@www6.paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4wndpelpgudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyelcpshowudj6x9ny-1seq-2-2.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
H:\Documents and Settings\John\Cookies\john@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmiggc5odqa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@112.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@adviva[2].txt -> Spyware.Cookie.Adviva : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@bfast[1].txt -> Spyware.Cookie.Bfast : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@commission-junction[1].txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@counter2.hitslink[2].txt -> Spyware.Cookie.Hitslink : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@server.iad.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
H:\Documents and Settings\Ruth\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wfk4kpdjilqawdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
J:\Documents and Settings\Admin\Cookies\admin@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
J:\Documents and Settings\Admin\Cookies\admin@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
J:\Documents and Settings\Admin\Cookies\admin@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
J:\Documents and Settings\Admin\Cookies\admin@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
J:\Documents and Settings\Admin\Cookies\admin@servedby.advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
J:\Documents and Settings\Admin\Local Settings\Temp\djtopr1150.exe -> Spyware.WebRebates.g : Cleaned with backup
J:\Documents and Settings\Admin\Local Settings\Temp\jkill.exe -> Spyware.VX2 : Cleaned with backup
J:\Documents and Settings\Admin\Local Settings\Temp\THI7984.tmp\preInsTT.exe -> Spyware.BiSpy : Cleaned with backup
J:\Documents and Settings\Admin\Local Settings\Temp\THI7984.tmp\twaintec.dll -> Spyware.BiSpy : Cleaned with backup
J:\Documents and Settings\Admin\re11.REG -> Trojan.LowZones.a : Cleaned with backup
J:\Program Files\BullsEye Network\bin\bargains.exe -> Spyware.BargainBuddy : Cleaned with backup
J:\Program Files\Web_Rebates\disp1150.exe -> Spyware.WebRebates : Cleaned with backup
J:\Program Files\Web_Rebates\Sy1150\Sy1150\1150_1.dat -> Spyware.TopMoxie : Cleaned with backup
J:\Program Files\Winad Client\ClientCom.dll -> Spyware.WinAD : Cleaned with backup
J:\temp\FLEOK\msbb.exe -> Spyware.180Solutions : Cleaned with backup
J:\WINDOWS\bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
J:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx -> Spyware.MediaTickets : Cleaned with backup
J:\WINDOWS\Downloaded Program Files\v2.dll -> Spyware.EliteBar : Cleaned with backup
J:\WINDOWS\Downloaded Program Files\WinadX.dll -> Downloader.Winupdt.a : Cleaned with backup
J:\WINDOWS\preInsTT.exe -> Spyware.BiSpy : Cleaned with backup
J:\WINDOWS\system32\apuc.dll -> Spyware.BargainBuddy : Cleaned with backup
J:\WINDOWS\system32\bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
J:\WINDOWS\system32\drivers\etc\hosts -> Trojan.Qhost : Cleaned with backup
J:\WINDOWS\system32\exdl.exe -> Adware.eXact : Cleaned with backup
J:\WINDOWS\system32\exul.exe -> Spyware.BargainBuddy : Cleaned with backup
J:\WINDOWS\system32\msbe.dll -> Spyware.BargainBuddy : Cleaned with backup
J:\WINDOWS\system32\mscb.dll -> Spyware.BargainBuddy : Cleaned with backup
J:\WINDOWS\system32\nvms.dll -> Spyware.BargainBuddy : Cleaned with backup
J:\WINDOWS\twaintec.dll -> Spyware.BiSpy : Cleaned with backup
J:\WINDOWS\udwn.exe -> Spyware.180Solutions : Cleaned with backup
P:\WINDOWS\system32\drivers\winik.sys -> Trojan.Rootkit.Agent.q : Cleaned with backup
P:\WINDOWS\nxstinst.exe -> Spyware.NavExcel : Cleaned with backup
P:\WINDOWS\remover.dll -> Spyware.NavExcel : Cleaned with backup
P:\Documents and Settings\John\Local Settings\Temporary Internet Files\Content.IE5\8DKXU78X\ikw[1].gif -> Spyware.CommonName.j : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@doubleclick[2].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-bskyb.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@bs.serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-guardian.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-newsinternational.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@www6.paypopup[2].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-hotgroup.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@valueclick[2].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@servedby.advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@adviva[1].txt -> Spyware.Cookie.Adviva : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wjk4alazoeo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@247realmedia[2].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@as-us.falkag[1].txt -> Spyware.Cookie.Falkag : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-aura.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@atdmt[3].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@doubleclick[3].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@adtech[1].txt -> Spyware.Cookie.Adtech : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@phg.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-logantod.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@bfast[3].txt -> Spyware.Cookie.Bfast : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wflicodzcbp.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wjlyqkajalq.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wjk4sodpcbo.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@qksrv[2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wjlygpdjklo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wfkocjczkao.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wjlocidjsgp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-guardian.hitbox[3].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@statse.webtrendslive[2].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@serving-sys[3].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-autotrader.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-eline.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@linksynergy[1].txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@mediaplex[3].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@www.epilot[1].txt -> Spyware.Cookie.Epilot : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ad1.clickhype[1].txt -> Spyware.Cookie.Clickhype : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-newsinternational.hitbox[3].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@revenue[2].txt -> Spyware.Cookie.Revenue : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@bluestreak[3].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-sonypictures.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-idgentertainment.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@targetnet[1].txt -> Spyware.Cookie.Targetnet : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ads.pointroll[1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@112.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@fastclick[3].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-hotgroup.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@e-2dj6wfkoand5kcq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@-- The nicest hobby on Earth ;) --tracker[1].txt -> Spyware.Cookie.-- The nicest hobby on Earth ;) --tracker : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-f5.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@as1.falkag[2].txt -> Spyware.Cookie.Falkag : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@adopt.specificclick[1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@adopt.euroclick[1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@server.iad.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@adviva[2].txt -> Spyware.Cookie.Adviva : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@hitbox[3].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\John\Cookies\john@ehg-aura.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@adviva[1].txt -> Spyware.Cookie.Adviva : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@ehg-bskyb.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@247realmedia[2].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@questionmarket[2].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@servedby.advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@112.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@bluestreak[3].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wjl4uocjacog2dj6x9ny-1seq-2-2.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wflighdjkaog2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlioidpckoq2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmiehdjeaqa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wflywpdzmapgydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyujczecqqwdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\Ruth.ATTIC-220904\Cookies\ruth@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyejczmboqydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
P:\Documents and Settings\

[MoANjAm]

Mosaic1,

and here are the other 3;

Hijackthis;
###############################

Logfile of HijackThis v1.99.1
Scan saved at 19:04:06, on 29/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Program Files\WinZip\WZQKPICK.EXE
E:\Program Files\Microsoft Office\Office\OSA.EXE
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\Program Files\ewido anti-malware\ewidoctrl.exe
E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\Microsoft Office\Office\Winword.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Documents and Settings\John\Desktop\Malware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - E:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [navapp] E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [Zenet] rundll32.exe E:\PROGRA~1\COMMON~2\Toolbar\CNBabe.dll,DllStartup
O4 - Startup: Office Startup.lnk = E:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Exif Launcher.lnk = E:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = E:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpg: E:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O15 - Trusted Zone: *.line6.net
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: V2i Protector - PowerQuest Corporation - E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

#################################

Startup list

#################################

"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NeroCheck" = "E:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"SunJavaUpdateSched" = "E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"AVG7_CC" = "E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
"AVG7_EMC" = "E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
"navapp" = "E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe" [file not found]
"Zenet" = "rundll32.exe E:\PROGRA~1\COMMON~2\Toolbar\CNBabe.dll,DllStartup" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{00000000-0000-0000-0000-000000000000}\(Default) = "BabeIE"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll" [file not found]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\Audiodev.dll" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{043308A2-3CF7-4ED5-A668-2B4FB0BD307A}" = "dBpowerAMP dAP Scripting"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Illustrate\dBpowerAMP\dBScripting.dll" ["Illustrate"]
"{FED7043D-346A-414D-ACD7-550D052499A7}" = "dBpowerAMP Popup Info"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Illustrate\dBpowerAMP\dBShell.dll" [empty string]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {CLSID}\InProcServer32\(Default) = "E:\WINDOWS\system32\browseui.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\ewido anti-malware\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\ewido anti-malware\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "E:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "E:\Documents and Settings\John\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "E:\WINDOWS\System32\logon.scr" [MS]


Startup items in "John" & "All Users" startup folders:
------------------------------------------------------

E:\Documents and Settings\John\Start Menu\Programs\Startup
"Office Startup" -> shortcut to: "E:\Program Files\Microsoft Office\Office\OSA.EXE -b" [MS]

E:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Exif Launcher" -> shortcut to: "E:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]
"InterVideo WinCinema Manager" -> shortcut to: "E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe" [empty string]
"WinZip Quick Pick" -> shortcut to: "E:\Program Files\WinZip\WZQKPICK.EXE" ["WinZip Computing, Inc."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"
-> {CLSID}\InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]

{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}\
"ButtonText" = "Yahoo! Messenger"
"MenuText" = "Yahoo! Messenger"
"Exec" = "E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe" ["Yahoo! Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "E:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AVG7 Alert Manager Server, Avg7Alrt, "E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
AVG7 Update Service, Avg7UpdSvc, "E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
ewido security suite control, ewido security suite control, "E:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"]
TrueVector Internet Monitor, vsmon, "E:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]
V2i Protector, V2i Protector, "E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe" ["PowerQuest Corporation"]
Windows User Mode Driver Framework, UMWdf, "E:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON V5 2KMonitor\Driver = "EBPMON2.DLL" ["SEIKO EPSON CORPORATION"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 22 seconds, including 8 seconds for message boxes)

########################################

Hijackthis - uninstall .log

Adobe Acrobat - Reader 6.0.2 Update
Adobe Acrobat and Reader 6.0.3 Update
Adobe Acrobat and Reader 6.0.4 Update
Adobe Reader 6.0.1
Advanced MP3 Converter 1.81
Ahead Nero Burning ROM
Ares 1.8.7
AVG Free Edition
Azureus
BitTorrent 4.0.2
coverXP (remove only)
dBpowerAMP
Deepnet Explorer
DivX
DivX Player
DVD Shrink 3.2
EPSON Printer Software
ewido anti-malware
FinePixViewer Ver.3.2
G-Force
Google Earth
GuitarPort
HijackThis 1.99.1
InterVideo WinDVD 4
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 4
JMeeting.com
LimeWire 4.9.23
Macromedia Flash Player 8
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Office 97, Professional Edition
Mozilla Firefox (1.5)
PowerQuest Drive Image 7.0
PowerQuest PartitionMagic 8.0
QuickTime
RealPlayer
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB912919)
SoulSeek Client 156c
TreeSize 1.75
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB910437)
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
WinRAR archiver
WinZip
XviD MPEG-4 Codec
Yahoo! Messenger
ZoneAlarm

cheers for all your help again

MoANjAm

[Mosaic1]

Hi,

You're welcome. The startuplist didn't get in there. I need that one too please.


Close all Internet Explorer wiondows and all folders.

Go to start >Run
Type hijackthis
Press enter

Select the folloiwing items and press the fix checked button:

O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - E:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll (file missing)
O4 - HKLM\..\Run: [navapp] E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
O4 - HKLM\..\Run: [Zenet] rundll32.exe E:\PROGRA~1\COMMON~2\Toolbar\CNBabe.dll,DllStartup
O15 - Trusted Zone: *.line6.net Unless you have this setup on purpose?


I strongly urge you to uninetall All File Sgaring and bit torrent clients. A lot ot infectoins get passed through those programs.

Azureus
BitTorrent 4.0.2
LimeWire 4.9.23
Ares 1.8.7

----------

There has been an issue found recently with Sun Java.

When newer versions are installed, the older versions are left behind and malware can call these older versions to exploit flaws. Some malware has been found to install this way.

First update to the very latest version of Sun Java, which is 1.5.0_06

Then go into Add Remove programs and uninstall any older versions you find listed there.

[MoANjAm]

Mosaic1,

I have yet to follow your guidelines today but im right on it. Startup list that you require:

StartupList report, 30/01/2006, 17:36:40
StartupList version: 1.52.2
Started from : E:\Documents and Settings\John\Desktop\Malware\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Program Files\WinZip\WZQKPICK.EXE
E:\Program Files\Microsoft Office\Office\OSA.EXE
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\Program Files\ewido anti-malware\ewidoctrl.exe
E:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Microsoft Office\Office\Winword.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Documents and Settings\John\Desktop\Malware\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[E:\Documents and Settings\John\Start Menu\Programs\Startup]
Office Startup.lnk = E:\Program Files\Microsoft Office\Office\OSA.EXE

Shell folders Common Startup:
[E:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Exif Launcher.lnk = E:\Program Files\FinePixViewer\QuickDCF.exe
InterVideo WinCinema Manager.lnk = E:\Program

Files\InterVideo\Common\Bin\WinCinemaMgr.exe
WinZip Quick Pick.lnk = E:\Program Files\WinZip\WZQKPICK.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = E:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NeroCheck = E:\WINDOWS\system32\NeroCheck.exe
SunJavaUpdateSched = E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
AVG7_CC = E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
AVG7_EMC = E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
navapp = E:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
Zenet = rundll32.exe E:\PROGRA~1\COMMON~2\Toolbar\CNBabe.dll,DllStartup

--------------------------------------------------

Shell & screensaver key from E:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=E:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

BabeIE - E:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll (file missing) -

{00000000-0000-0000-0000-000000000000}
(no name) - E:\Program Files\Adobe\Acrobat

6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Download Program Files:

[QuickTime Object]
InProcServer32 = E:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave Flash Object]
InProcServer32 = E:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE =

http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: E:\WINDOWS\system32\SHELL32.dll
CDBurn: E:\WINDOWS\system32\SHELL32.dll
WebCheck: E:\WINDOWS\system32\webcheck.dll
SysTray: E:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 4,883 bytes
Report generated in 0.047 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of

platform
/history - to list version history only

[Mosaic1]

Hi,

Please do th erest before posting a Staruplist. I need to see the results of what yo uhave done.

Also, you gave me just the defaults. I need to see more please.

Button
Click Misc Tools
Check both boxes next to the Generate StartupList log and then click the generate startuplist log button.