I think Im infected — malwareremoval.com Archive

Geezer

February 22, 2006, 8:09 PM UTC

I have had a problem with a window that opens when i log into IE . It says " zipklix toolbar is trying to install " Plus my computer is slow and the programs window opens everytime I start up . I am a novice with computers and hope someone can help . Thanks

Logfile of HijackThis v1.99.1
Scan saved at 21:01:58, on 22/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Sygate\SPF\smc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\Program\Creative\SBLive\Diagnostics\diagent.exe
C:\Program\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Creative\ShareDLL\CtNotify.exe
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\Program\Java\jre1.5.0_06\bin\jusched.exe
C:\Program\Microsoft AntiSpyware\gcasServ.exe
C:\Program\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program\Creative\ShareDLL\Mediadet.exe
C:\Program\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\Tony\Mina dokument\Rippleffect\Pocket Pardew\pardew.exe
C:\Program\Webroot\Washer\wwDisp.exe
C:\Program\Digital Line Detect\DLG.exe
C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program\Personal\bin\Personal.exe
C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe
C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearchIndexer.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.whufc.com/index.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/s ... efault.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LÃ¤nkar
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\Program\DELADE~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - blank (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar1.dll
O2 - BHO: MSNÂ Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\Program\DELADE~1\Real\Toolbar\realbar.dll
O3 - Toolbar: (no name) - {5AA06644-BC46-4220-A460-47A6EB47C96D} - (no file)
O3 - Toolbar: MSNÂ Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [diagent] C:\Program\Creative\SBLive\Diagnostics\diagent.exe startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SmcService] C:\Program\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Program\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [Pocket Pardew] C:\Documents and Settings\Tony\Mina dokument\Rippleffect\Pocket Pardew\pardew.exe
O4 - HKCU\..\Run: [Window Washer] C:\Program\Webroot\Washer\wwDisp.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe
O8 - Extra context menu item: &Google Search - res://c:\program\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll/search.htm
O8 - Extra context menu item: &Translate English Word - res://c:\program\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Ã–ppna pÃ¥ ny flik i bakgrunden - res://C:\Program\MSN Toolbar Suite\TAB\02.05.0000.1105\sv-se\msntabres.dll/229?de14b095d21146f490853f855df59b12
O8 - Extra context menu item: Ã–ppna pÃ¥ ny flik i fÃ¶rgrunden - res://C:\Program\MSN Toolbar Suite\TAB\02.05.0000.1105\sv-se\msntabres.dll/230?de14b095d21146f490853f855df59b12
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\Program\SYSTEM~1\autocomp.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program\Delade filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program\Sygate\SPF\smc.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

Rogue MRU Teacher Emeritus

February 23, 2006, 3:40 AM UTC

Hi Geezer,

Welcome to Malware Removal Forums.

My name is Scott and as we work together to resolve you problem please read the instructions carefully. You may wish to print them off or copy them into Notepad.
If you have question please don't hesitate to ask.
The instructions I give are specific to your current problem and should not be used on other problems.
Post your replies to this thread only.
Since there may other issues with your system please continue to follow this thread until I have given you an "All Clean."

Ready? Let's go.
====================

Spybot S&D is available from here.

Download and Install Spybot S&D (if you haven't already), accept the Default Settings
In the Menu Bar at the top of the Spybot window you will see Mode.
Make certain that 'Default Mode has a check mark beside it.
Close ALL windows except Spybot S&D
Click the button to 'Search for Updates' then download and install the updates.
Next click the button 'Check for Problems'
When Spybot is complete, it will be showing 'RED' entries bold 'BLACK' entries and 'GREEN' entries in the window
Make certain there is a check mark beside all of the RED entries ONLY.
Choose 'Fix Selected Problems' and allow Spybot to fix the RED entries.
====================

Download and install Ewido Anti-Malware

During the installation, uncheck the following under Additional Options:
Install background guard
Install scan via context menu

Check for updates
Do not run it yet
====================

Download ATF Cleaner by Atribune and save it to your Desktop.
====================

Please go to:
Start
Control panel
Add/Remove programs
Find and remove these programs (if they are present)

Burn4Free

(If some programs listed are not present, please do not panic)
===================

Start HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - blank (file missing)
O3 - Toolbar: (no name) - {5AA06644-BC46-4220-A460-47A6EB47C96D} - (no file)

CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked
=====================

Please print the instructions below or copy and paste to Notepad since you will not have internet access while in safe mode.
Then reboot your computer
As soon as it starts to boot, rapidly press the f8 key.
Select Safe Mode from the menu
If you are still unsure, see here
==========
Double click ATF-Cleaner.exe to run the program.

Check the boxes to the left of:

Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache

The rest are optional - if you want to remove the lot, check "Select All".
Finally click Empty Selected. When you get the "Done Cleaning" message, click OK.
====================

Run ewido Malware Remover

Click on Scanner
Click on Complete System Scan and the scan will begin.
While the scan is in progress you will be prompted to clean files, click OK
Select "none" as the action. Check "Perform action with all infections".
Once the scan has completed, there will be a button located on the bottom of the screen named Save report - click it.
Save the report.txt file to your desktop.

Now close ewido security suite.

Warning: While the scan is in progress, DO NOT open any folders or the Windows Control Panel !!
====================

Run Panda's ActiveScan from here and perform a full system scan.

1. Once you are on the Panda site click the "Scan your PC" button
2. A new window will open...click the big "Check Now" button
3. Enter your Country
4. Enter your State/Province
5. Enter your e-mail address and click send
6. Select either Home User or Company
7. Click the big Scan Now button
8. If it wants to install an ActiveX component allow it
9. It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
10. Click on "Local Disks" to start the scan
11. Post Panda scan results in your next reply
====================

Please post the following
New HJT Log
ewido Report
Panda Scan Log
How is your system is behaving

Thanks,
Rogue

Geezer

February 23, 2006, 12:58 PM UTC

This is the new hijack report followed by the ewido report , I tried the panda scan from the link on here but when I clicked on the scan button a new window flickered but never came up , i tried this a few times with no luck.

Logfile of HijackThis v1.99.1
Scan saved at 13:53:03, on 23/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Sygate\SPF\smc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program\ALWILS~1\Avast4\ashDisp.exe
C:\Program\Creative\ShareDLL\CtNotify.exe
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\Program\Java\jre1.5.0_06\bin\jusched.exe
C:\Program\Microsoft AntiSpyware\gcasServ.exe
C:\Program\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program\Creative\ShareDLL\Mediadet.exe
C:\Program\Logitech\Video\LogiTray.exe
C:\Program\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\Tony\Mina dokument\Rippleffect\Pocket Pardew\pardew.exe
C:\Program\Webroot\Washer\wwDisp.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program\Digital Line Detect\DLG.exe
C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program\Personal\bin\Personal.exe
C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe
C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearchIndexer.exe
C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearchFilter.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.whufc.com/index.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/s ... efault.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LÃ¤nkar
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\Program\DELADE~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar1.dll
O2 - BHO: MSNÂ Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\Program\DELADE~1\Real\Toolbar\realbar.dll
O3 - Toolbar: MSNÂ Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [diagent] C:\Program\Creative\SBLive\Diagnostics\diagent.exe startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SmcService] C:\Program\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Program\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [Pocket Pardew] C:\Documents and Settings\Tony\Mina dokument\Rippleffect\Pocket Pardew\pardew.exe
O4 - HKCU\..\Run: [Window Washer] C:\Program\Webroot\Washer\wwDisp.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe
O8 - Extra context menu item: &Google Search - res://c:\program\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll/search.htm
O8 - Extra context menu item: &Translate English Word - res://c:\program\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Ã–ppna pÃ¥ ny flik i bakgrunden - res://C:\Program\MSN Toolbar Suite\TAB\02.05.0000.1105\sv-se\msntabres.dll/229?de14b095d21146f490853f855df59b12
O8 - Extra context menu item: Ã–ppna pÃ¥ ny flik i fÃ¶rgrunden - res://C:\Program\MSN Toolbar Suite\TAB\02.05.0000.1105\sv-se\msntabres.dll/230?de14b095d21146f490853f855df59b12
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\Program\SYSTEM~1\autocomp.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program\ewido anti-malware\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program\Delade filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program\Sygate\SPF\smc.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

Ewido report

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 13:41:46, 23/02/2006
+ Report-Checksum: 7A7CF8A5

+ Scan result:

C:\Documents and Settings\Leah\Cookies\leah@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@7search[2].txt -> TrackingCookie.7search : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Adition : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@bfast[2].txt -> TrackingCookie.Bfast : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted]-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@centrport[2].txt -> TrackingCookie.Centrport : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@com[2].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@linksynergy[1].txt -> TrackingCookie.Linksynergy : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Fastclick : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@overture[2].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@revenue[2].txt -> TrackingCookie.Revenue : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Advertising : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@starware[2].txt -> TrackingCookie.Starware : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Webtrendslive : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@valueclick[3].txt -> TrackingCookie.Valueclick : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@weborama[1].txt -> TrackingCookie.Weborama : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@webstat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Belstat : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Etracker : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][2].txt -> TrackingCookie.Smartadserver : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\[redacted][1].txt -> TrackingCookie.Adserver : Cleaned with backup
C:\Documents and Settings\Leah\Cookies\leah@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup
C:\Program\Microsoft AntiSpyware\Quarantine\6A1DCD30-FACD-4A3F-A65E-E403D9\1406DDCD-C97F-444F-95DB-449E03 -> Adware.NavExcel : Cleaned with backup
C:\Program\Microsoft AntiSpyware\Quarantine\6A1DCD30-FACD-4A3F-A65E-E403D9\2FE0002A-32C2-4B6A-8666-DAEDD0 -> Adware.NavExcel : Cleaned with backup
C:\Program\Microsoft AntiSpyware\Quarantine\6A1DCD30-FACD-4A3F-A65E-E403D9\4D2B2BDD-EFAA-4627-920C-D1B250 -> Adware.NavExcel : Cleaned with backup
C:\Program\Microsoft AntiSpyware\Quarantine\6A1DCD30-FACD-4A3F-A65E-E403D9\F8958D4B-79C9-4770-A51B-CAB5FF -> Adware.NavExcel : Cleaned with backup
C:\System Volume Information\_restore{B19406CB-15FE-4643-899E-BE44508A1787}\RP458\A0047812.exe -> Adware.Casino : Cleaned with backup
C:\System Volume Information\_restore{B19406CB-15FE-4643-899E-BE44508A1787}\RP481\A0054206.exe -> Adware.Casino : Cleaned with backup

::Report End

Rogue MRU Teacher Emeritus

February 23, 2006, 2:19 PM UTC

Hi Geezer,

I tried the panda scan from the link on here but when I clicked on the scan button a new window flickered but never came up , i tried this a few times with no luck.

Could of been that I forgot to have you reboot into Normal Mode before. If you would like to try it again in normal mode and post the log. If Panda will still not work you can try Kapersky.

Run an online virus scan called Kapersky from here.

1. Click on "Kapersky Online Scanner"
2. A new smaller window will pop up. Press on "Accept". After reading the contents.
3. Now Kapersky will update the anti-virus database. Let it run.
4. Click on "Next">"Scan Settings", and make sure the database is set to "extended". And check both the scan options. Then click OK.
5. Then click on "My Computer". And the scan will start.
6. Once finished, save a log as ".txt" to the desktop. And restart.

I'll look at your current HJT and wait for either a Panda or Kapersky before posting another reply.

Was the popup you were getting before zipklix or was it zipclix? Are you still getting those?
Thanks

Geezer

February 23, 2006, 2:23 PM UTC

I managed to get " Bit defender to " work , here is the report , I made a mistake and it save as an html doc , I hope this dont mateer , thanks for your help

<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner -Scan Report</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<meta name="generator" content="Namo WebEditor v5.0(Trial)">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >

<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
BitDefender
Online Scanner
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>
<tr>
<td colspan="3" width="912">
Scan report generated
at: Thu, Feb 23, 2006 - 15:17:20
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
Scan
path: A:\;C:\;D:\;E:\;
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Statistics
</td>
</tr>
<tr>
<td width="57%">
Time
</td>
<td width="43%" align="right">
00:45:13
</td>
</tr>
<tr>
<td width="57%">
Files
</td>
<td width="43%" align="right">
303415
</td>
</tr>
<tr>
<td width="57%">
Folders
</td>
<td width="43%" align="right">
5286
</td>
</tr>
<tr>
<td width="57%">
Boot Sectors
</td>
<td width="43%" align="right">
3
</td>
</tr>
<tr>
<td width="57%">
Archives
</td>
<td width="43%" align="right">
5547
</td>
</tr>
<tr>
<td width="57%">
Packed Files
</td>
<td width="43%" align="right">
17541
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Results
</td>
</tr>
<tr>
<td width="57%">
Identified Viruses 
</td>
<td width="43%" align="right">
2
</td>
</tr>
<tr>
<td width="57%">
Infected Files 
</td>
<td width="43%" align="right">
35
</td>
</tr>
<tr>
<td width="57%">
Suspect Files 
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Warnings
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Disinfected
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Deleted Files
</td>
<td width="43%" align="right">
35
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Engines Info
</td>
</tr>
<tr>
<td width="57%">
Virus Definitions
</td>
<td width="43%" align="right">
274496
</td>
</tr>
<tr>
<td width="57%">
Engine build
</td>
<td width="43%" align="right">
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)
</td>
</tr>
<tr>
<td width="57%">
Scan plugins
</td>
<td width="43%" align="right">
13
</td>
</tr>
<tr>
<td width="57%">
Archive plugins
</td>
<td width="43%" align="right">
39
</td>
</tr>
<tr>
<td width="57%">
Unpack plugins
</td>
<td width="43%" align="right">
4
</td>
</tr>
<tr>
<td width="57%">
E-mail plugins
</td>
<td width="43%" align="right">
6
</td>
</tr>
<tr>
<td width="57%">
System plugins
</td>
<td width="43%" align="right">
1
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Scan Settings
</td>
</tr>
<tr>
<td width="57%">
First Action
</td>
<td width="43%" align="right">
Disinfect
</td>
</tr>
<tr>
<td width="57%">
Second Action
</td>
<td width="43%" align="right">
Delete
</td>
</tr>
<tr>
<td width="57%">
Heuristics
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Enable Warnings
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scanned Extensions
</td>
<td width="43%" align="right">
*;
</td>
</tr>

<tr>
<td width="57%">
Exclude Extensions
</td>
<td width="43%" align="right">
 
</td>
</tr>
<tr>
<td width="57%">
Scan Emails
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Archives
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Packed
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Files
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Boot
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td colspan=2>
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
Scanned File
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
 Status
</td>
</tr>
<tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000004
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000004
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000005
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000005
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000006
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000006
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000007
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000007
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000008
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000008
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000009
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000009
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000A
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000A
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000B
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000B
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000C
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000C
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000D
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000D
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000E
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000E
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000F
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000000F
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000010
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000010
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000011
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000011
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000012
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000012
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000013
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000013
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000014
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000014
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000015
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000015
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000016
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000016
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000017
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000017
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000018
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000018
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000019
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000019
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001A
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001A
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001B
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001B
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001C
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001C
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001D
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001D
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001E
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001E
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001F
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\0000001F
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000020
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000020
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000021
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000021
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000022
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000022
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000023
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000023
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000024
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000024
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000025
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000025
</td>
<td width="43%" align="left">
Deleted
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000026
</td>
<td width="43%" align="left">
Infected with: [redacted]
</td>
</tr><tr>
<td width="57%">
C:\Program\Alwil Software\Avast4\DATA\chest\00000026
</td>
<td width="43%" align="left">
Deleted
</td>
</tr>
</table>
</td>

<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

</table>
 

</body>
</html>

Geezer

February 23, 2006, 3:00 PM UTC

I have tried the "pandascan " and the "kapersky scan " with no luck . I click to scan and a window flickers and disapears. The only scan that worked is the one I posted . As far as the other problems , they are still there. Its a " Microsoft Antispyware notice Warning " saying that Zipclix Toolbar is trying to install , I click to remove , it then says "The threat has been succesfully removed " , but it happens everytime I start the computer up and I am also logged in to the internet automaticaly . And at the same time The Programs window opens , These 2 things are just a pain as I have to go through the motions everytime I start up my computer . Thanks

Rogue MRU Teacher Emeritus

February 23, 2006, 6:39 PM UTC

Hi Geezer,

I managed to get " Bit defender to " work , here is the report , I made a mistake and it save as an html doc , I hope this dont mateer , thanks for your help

Not a problem I was able to view it in an HTML editor. Looks like BitDefender deleted everything it found.

As far as the other problems , they are still there. Its a " Microsoft Antispyware notice Warning " saying that Zipclix Toolbar is trying to install , I click to remove , it then says "The threat has been succesfully removed " , but it happens everytime I start the computer up and I am also logged in to the internet automaticaly . And at the same time The Programs window opens , These 2 things are just a pain as I have to go through the motions everytime I start up my computer

Thanks for clarifying that it is zipclix. Zipclix is an ad based Internet Explorer search toolbar that is bundled with System Soap and also InternetWasher Pro.
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076020

Although I see no signs of zipclix let's see what we can find that may be causing it.

Please go to:
Start
Control panel
Add/Remove programs
Find and remove these programs (if they are present)

System Soap
InternetWasher Pro

(If some programs listed are not present, please do not panic)
====================

Please Download the following tool to assist us in locating any that may be hiding!

Download WinPFind from here
Right Click the Zip Folder and Select "Extract All"
Extract it somewhere you will remember like the Desktop

Reboot into Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Doubleclick WinPFind.exe
Click "Start Scan"
It will scan the entire System, so please be patient!
Once the Scan is Complete, go to the WinPFind folder, locate WinPFind.txt
Place those results in the next post!

Thanks,
Rogue

Geezer

February 23, 2006, 7:30 PM UTC

I wnet in to remove program but niether of them two programs were listed . Here is the report from the scan

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â» Windows OS and Versions Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â» Checking Selected Standard Folders Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
PECompact2 14/08/2004 21:31:24 9563466 C:\WINDOWS\LPT$VPN.955
UPX! 18/04/2005 13:49:26 57344 C:\WINDOWS\Unwash6.exe
PECompact2 14/08/2004 21:31:24 9563466 C:\WINDOWS\VPTNFILE.955
UPX! 14/08/2004 21:31:24 1036800 C:\WINDOWS\vsapi32.dll
aspack 14/08/2004 21:31:24 1036800 C:\WINDOWS\vsapi32.dll

Checking %System% folder...
UPX! 27/01/2006 23:38:10 503296 C:\WINDOWS\SYSTEM32\aswBoot.exe
PEC2 11/09/2002 05:00:00 41118 C:\WINDOWS\SYSTEM32\DFRG.MSC
PEC2 28/09/2005 22:29:14 693248 C:\WINDOWS\SYSTEM32\DivX.dll
PECompact2 28/09/2005 22:29:14 693248 C:\WINDOWS\SYSTEM32\DivX.dll
PTech 09/11/2005 11:30:32 534280 C:\WINDOWS\SYSTEM32\LegitCheckControl.dll
PECompact2 07/02/2006 21:28:40 4513120 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 07/02/2006 21:28:40 4513120 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 04/08/2004 09:33:22 712704 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 04/08/2004 09:33:52 665088 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 11/09/2002 05:00:00 1309184 C:\WINDOWS\SYSTEM32\WBDBASE.DEU

Checking %System%\Drivers folder and sub-folders...
PTech 04/08/2004 06:41:38 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\ETC\HOSTS

Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
23/02/2006 20:11:00 S 2048 C:\WINDOWS\BOOTSTAT.DAT
23/02/2006 18:50:26 H 54156 C:\WINDOWS\QTFont.qfn
11/01/2006 23:01:22 S 8792 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB911564.cat
13/01/2006 13:51:12 S 7898 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB911565.cat
04/01/2006 06:39:36 S 11223 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB911927.cat
03/01/2006 00:09:36 S 11223 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB912919.cat
13/01/2006 20:28:30 S 10925 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB913446.cat
23/02/2006 20:10:52 H 8192 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
23/02/2006 20:11:24 H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
23/02/2006 20:11:02 H 16384 C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
23/02/2006 20:11:42 H 69632 C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
23/02/2006 20:11:12 H 1122304 C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
17/02/2006 09:03:18 H 1024 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NTUSER.DAT.LOG
19/02/2006 11:23:50 S 688 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
19/01/2006 05:40:56 S 1047 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\7C8A03C4580C6B04FDF34357F3474EDC
19/01/2006 05:40:56 S 1370 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\B82262A5D5DA4DDACE9EDA7F787D0DEB
19/02/2006 11:23:50 S 70226 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\F482C95F83F1B59228F1B1E720F2EDF1
19/02/2006 11:23:50 S 94 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
19/01/2006 05:40:56 S 126 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\7C8A03C4580C6B04FDF34357F3474EDC
19/01/2006 05:40:56 S 194 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\B82262A5D5DA4DDACE9EDA7F787D0DEB
19/02/2006 11:23:50 S 128 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\F482C95F83F1B59228F1B1E720F2EDF1
28/01/2006 22:39:06 HS 388 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\1aadbef8-e23b-41af-8a9b-12db8dbe746c
28/01/2006 22:39:06 HS 24 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\Preferred
23/02/2006 20:10:16 H 6 C:\WINDOWS\Tasks\SA.DAT

Checking for CPL files...
Microsoft Corporation 04/08/2004 09:34:52 69632 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 04/08/2004 09:34:52 551424 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 04/08/2004 09:34:52 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Logitech Inc. 08/10/2004 12:23:58 282624 C:\WINDOWS\SYSTEM32\camcpl.cpl
Creative Technology Ltd. 30/03/2001 02:00:00 230912 C:\WINDOWS\SYSTEM32\CTDetect.cpl
Creative Technology Ltd. 21/02/2002 01:00:00 212992 C:\WINDOWS\SYSTEM32\CTDevCtrl.cpl
Microsoft Corporation 04/08/2004 09:34:52 136192 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 04/08/2004 09:34:52 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 04/08/2004 09:34:52 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Microsoft Corporation 04/08/2004 09:34:52 358912 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 04/08/2004 09:34:52 131072 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 04/08/2004 09:34:52 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 04/08/2004 09:34:52 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems, Inc. 10/11/2005 13:03:50 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 11/09/2002 05:00:00 188416 C:\WINDOWS\SYSTEM32\MAIN.CPL
Microsoft Corporation 04/08/2004 09:34:52 620032 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 11/09/2002 05:00:00 35840 C:\WINDOWS\SYSTEM32\NCPA.CPL
Microsoft Corporation 04/08/2004 09:34:52 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 04/08/2004 09:34:52 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 04/08/2004 09:34:52 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 04/08/2004 09:34:52 115712 C:\WINDOWS\SYSTEM32\powercfg.cpl
Intel(R) Corporation 11/03/2003 16:15:56 77824 C:\WINDOWS\SYSTEM32\PRApplet.cpl
Microsoft Corporation 04/08/2004 09:34:52 299008 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 11/09/2002 05:00:00 28160 C:\WINDOWS\SYSTEM32\TELEPHON.CPL
Microsoft Corporation 04/08/2004 09:34:52 93696 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 04/08/2004 09:34:52 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 26/05/2005 03:16:34 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 26/05/2005 03:16:34 174360 C:\WINDOWS\SYSTEM32\DLLCACHE\wuaucpl.cpl

Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â» Checking Selected Startup Folders Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

Checking files in %ALLUSERSPROFILE%\Startup folder...
03/05/2005 17:24:38 942 C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Adobe Gamma Loader.exe.lnk
01/10/2002 14:31:46 HS 84 C:\Documents and Settings\All Users\Start-meny\Program\Autostart\DESKTOP.INI
14/10/2003 21:41:20 525 C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Digital Line Detect.lnk
27/08/2004 17:46:24 1775 C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Kodak EasyShare software.lnk
07/01/2006 11:44:14 1869 C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Logitech Desktop Messenger.lnk
16/10/2005 12:26:56 808 C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Personal.lnk
11/10/2005 15:04:54 2099 C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Windows Desktop Search.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
01/10/2002 14:22:14 HS 62 C:\Documents and Settings\All Users\Application Data\DESKTOP.INI

Checking files in %USERPROFILE%\Startup folder...
01/10/2002 14:31:46 HS 84 C:\Documents and Settings\Tony\Start-meny\Program\Autostart\DESKTOP.INI

Checking files in %USERPROFILE%\Application Data folder...
01/10/2002 14:22:14 HS 62 C:\Documents and Settings\Tony\Application Data\DESKTOP.INI

Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â» Checking Selected Registry Keys Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\avast
{472083B0-C522-11CF-8763-00608CC02F24} = C:\Program\Alwil Software\Avast4\ashShell.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Macromedia.FlashPaper.ContextMenu
{9DED7A30-D572-4D21-8D82-6945EA697400} = C:\Program\Macromedia\FlashPaper 2\FlashPaperContextMenu.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Washer
{6EE51AA0-77A0-11D7-B4E1-000347126E46} = C:\Program\DELADE~1\WEBROO~1\SHELLW~1.DLL
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
=
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
PIN-kod fÃ¶r Start-menyn = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\avast
{472083B0-C522-11CF-8763-00608CC02F24} = C:\Program\Alwil Software\Avast4\ashShell.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
=

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Washer
{6EE51AA0-77A0-11D7-B4E1-000347126E46} = C:\Program\DELADE~1\WEBROO~1\SHELLW~1.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
=

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Yahoo! Toolbar Helper = C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D}
REALBAR = C:\Program\DELADE~1\Real\Toolbar\realbar.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
= C:\Program\Spybot - Search & Destroy\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
SSVHelper Class = C:\Program\Java\jre1.5.0_06\bin\ssv.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
Google Toolbar Helper = c:\program\google\googletoolbar1.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
MSNÂ Search Toolbar Helper = C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Dagens tips = %SystemRoot%\System32\shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} = REALBAR : C:\Program\DELADE~1\Real\Toolbar\realbar.dll
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} = MSNÂ Search Toolbar : C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
{EF99BD32-C1FB-11D2-892F-0090271D4F88} = Yahoo! Toolbar : C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\program\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java-konsol : C:\Program\Java\jre1.5.0_06\bin\npjpi150_06.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66}
MenuText = Uninstall BitDefender Online Scanner v8 :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = Messenger : C:\Program\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{21569614-B795-46B1-85F4-E737A8DC09AD}
Shell Search Band = %SystemRoot%\system32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}
Search Band = %SystemRoot%\System32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
History Band = %SystemRoot%\System32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{319A68DB-06D0-46DA-9F93-A810D5A70836} = :
{5AA06644-BC46-4220-A460-47A6EB47C96D} = :
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} = MSNÂ Search Toolbar : C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program\google\googletoolbar1.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Adress : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &LÃ¤nkar : %SystemRoot%\system32\SHELL32.dll
{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} = REALBAR : C:\Program\DELADE~1\Real\Toolbar\realbar.dll
{5AA06644-BC46-4220-A460-47A6EB47C96D} = :
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} = MSNÂ Search Toolbar : C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program\google\googletoolbar1.dll
{EF99BD32-C1FB-11D2-892F-0090271D4F88} = Yahoo! Toolbar : C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
diagent C:\Program\Creative\SBLive\Diagnostics\diagent.exe startup
UpdReg C:\WINDOWS\UpdReg.EXE
DVDSentry C:\WINDOWS\System32\DSentry.exe
AdaptecDirectCD "C:\Program\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
LXSUPMON C:\WINDOWS\System32\LXSUPMON.EXE RUN
avast! C:\Program\ALWILS~1\Avast4\ashDisp.exe
Disc Detector C:\Program\Creative\ShareDLL\CtNotify.exe
TkBellExe "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
SunJavaUpdateSched C:\Program\Java\jre1.5.0_06\bin\jusched.exe
gcasServ "C:\Program\Microsoft AntiSpyware\gcasServ.exe"
QuickTime Task "C:\Program\QuickTime\qttask.exe" -atboottime
LVCOMSX C:\WINDOWS\system32\LVCOMSX.EXE
LogitechVideoRepair C:\Program\Logitech\Video\ISStart.exe
LogitechVideoTray C:\Program\Logitech\Video\LogiTray.exe
SmcService C:\Program\Sygate\SPF\smc.exe -startgui

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE C:\WINDOWS\system32\ctfmon.exe
LDM C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
LogitechSoftwareUpdate C:\Program\Logitech\Video\ManifestEngine.exe boot
Pocket Pardew C:\Documents and Settings\Tony\Mina dokument\Rippleffect\Pocket Pardew\pardew.exe
Window Washer C:\Program\Webroot\Washer\wwDisp.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
Index Washer C:\Program\Webroot\Washer\WashIdx.exe "Tony"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

NoDriveTypeAutoRun _

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\Program\DELADE~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon
= WgaLogon.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs

Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â» Scan Complete Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»Â»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 23/02/2006 20:20:56

Thanks

Rogue MRU Teacher Emeritus

February 23, 2006, 7:34 PM UTC

Thanks geezer. I'll get to work on this log.

Rogue MRU Teacher Emeritus

February 24, 2006, 3:10 AM UTC

Hi Geezer,

I have found nothing in either HJT or WinPFind that is associated with what is known to install Zipclix.
Zipclix is a webwasher much like Webroots Washer you currently have installed.

Please show me an uninstall of programs.
This is how you do that:
Open HiJackThis
Click on the tab "Open the Misc Tools Session"
Click on the Box that says "Uninstall Manager"
Click on the button "Save list"
Copy and past the List from notepad into your post
====================

You can clean out the quaratine files in ewido

If you can give me anymore information from the message you get from MS AntiSpyware it may help.

Thanks,
Rogue

Geezer

February 24, 2006, 8:34 AM UTC

Here is the list you asked for . Would it help if I took a screen shot of the zipclix problem with all the info or would the files be too big . otherwise I will have to work on it and send you the details , it might take some time . thanks

Ad-Aware SE Personal
Adobe Photoshop 5.5
aspi
avast! Antivirus
CCHelp
CCleaner (remove only)
CCScore
Classic PhoneTools
CoffeeCup Free HTML Editor
CoffeeCup HTML Editor 2005
Conexant SmartHSFi V92 56K Speakerphone PCI Modem
Dell Solution Center
Digital Camera Driver
Digital Line Detect
Disc2Phone
DivX
DivX Player
Drivrutiner till LogitechÂ® Camera
DVDSentry
Easy CD Creator 5 Basic
ESSAdpt
ESSANUP
ESSCAM
ESSCDBK
ESScore
ESSgui
ESShelp
ESSini
ESSPCD
ESSvpaht
ESSvpot
ewido anti-malware
Google Earth
Google Toolbar for Internet Explorer
HijackThis 1.99.1
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet
IrfanView (remove only)
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Kodak EasyShare software
KSU
LeadTool
Lexmark Supplies Monitor
Lexmark Z65
LimeWire PRO 4.9.30
LiveReg (Symantec Corporation)
LiveUpdate 1.80 (Symantec Corporation)
Logitech Desktop Messenger
Logitech Print Service
Logitech QuickCam Software
Macromedia Contribute 3
Macromedia Flash Player 8
MGI PhotoSuite 4 (Remove Only)
MGI Photovista 2.02(Remove only)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft AntiSpyware
Microsoft Data Access Components KB870669
Microsoft Works 7.0
Modem Helper
MSN Messenger 7.5
MSNÂ Search Toolbar
Music Manager
NetWaiting
Notifier
NVIDIA Windows 2000/XP Display Drivers
OTtBP
PCDADDIN
PCDHELP
PCDLNCH
PCDrdsho
Personal 4.2.3
Photo DVD Maker 3.10
Pimbolis Dachboden
Plaxo
PowerDVD
RealPlayer
Roxio VideoWave Movie Creator
SÃ¤kerhetsuppdatering fÃ¶r Step by Step Interactive Training (KB898458)
SÃ¤kerhetsuppdatering fÃ¶r Windows Media Player (KB911564)
SÃ¤kerhetsuppdatering fÃ¶r Windows Media Player 10 (KB911565)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB883939)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB890046)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB893756)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB896358)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB896422)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB896423)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB896424)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB896428)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB896688)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB899587)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB899588)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB899591)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB900725)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB901017)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB901190)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB901214)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB902400)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB903235)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB904706)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB905414)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB905749)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB905915)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB908519)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB911927)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB912919)
SÃ¤kerhetsuppdatering fÃ¶r Windows XP (KB913446)
SFR
SFR2
Sony Ericsson PC Suite
Sound Blaster Live!
Spybot - Search & Destroy 1.4
SpywareBlaster v2.6.1
Surftips fÃ¶r Internet
Sygate Personal Firewall Pro
United Devices Agent
Uppdatering fÃ¶r Windows XP (KB894391)
Uppdatering fÃ¶r Windows XP (KB896727)
Uppdatering fÃ¶r Windows XP (KB898461)
Uppdatering fÃ¶r Windows XP (KB910437)
USB MassStorage CardReader
Window Washer
Windows Genuine Advantage Notifications
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinMX
Yahoo! Toolbar

Rogue MRU Teacher Emeritus

February 24, 2006, 3:47 PM UTC

Hi geezer,

A screenshot would be great. Also any information from your MS AntiSpyware log if it creates one.
If your not sure how to post a screenshot here you can email it to me
hddofutATaoldot com
replace AT with @ and dot with .

Rogue

Rogue MRU Teacher Emeritus

February 25, 2006, 4:06 AM UTC

Hi Geezer,

Thanks for the screenshot of the log. As you could tell there was nothing there. If you can get one of the popup then send it the same way.
Looking at your program list i can't see any programs that would be bundled with malware. The closet would be Limewire but you have the newest version and it's paid for.

Thanks
Rogue

Rogue MRU Teacher Emeritus

February 26, 2006, 10:13 PM UTC

Hi Geezer,

The whufc is West Ham football clubs homepage , which I have as my start page . I used to have to log in with password etc before for the internet but now it logs in automatic .

This could be the reason for the startup problem. Change your start page to something like google.com and see if it happens again on start up

The Pocket Pardew is from WHUFC its a icon thats is on the screen and when there is any news from WHUFC a small window open with the news .

I want to rule out the .exe file is not causing problems. I'll have you scan it through Jotti.

One thing that I have just noticed . When I start up the computer and go to my user name "Tony " the only thing that I get is "The windows Program" window opening and when my duaghter then goes to her user Name " Leah " everything is ok . But if she goes in first and then me , I get the Zipclix problem . I dont know if any of this is relevent.

Just to rule it out please include a HJT Log from Leah's login.

Please do the following:

Submit File to Jotti
Please click on Jotti <http://virusscan.jotti.org/>
Use the "Browse" button and locate the following file on your computer:

C:\Documents and Settings\Tony\Mina dokument\Rippleffect\Pocket Pardew\pardew.exe

Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
<http://www.virustotal.com/xhtml/index_en.html>
====================

Open HiJackThis
Click on Open the Misc tools Section button
Click Generate StartupList Log
Click Yes at the prompt
When the list is complete, select the whole log (Ctrl-A), copy and paste the log contents in a reply.
====================

Post Jotti results
Post Startup log
Post HJT (Leah)

Rogue

Geezer

February 27, 2006, 7:53 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 08:50:58, on 27/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Sygate\SPF\smc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Alwil Software\Avast4\aswUpdSv.exe
C:\Program\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program\Alwil Software\Avast4\ashMaiSv.exe
C:\Program\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program\Creative\SBLive\Diagnostics\diagent.exe
C:\Program\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program\Creative\ShareDLL\CtNotify.exe
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\Program\Microsoft AntiSpyware\gcasServ.exe
C:\Program\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program\Creative\ShareDLL\Mediadet.exe
C:\Program\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\Logitech\Video\FxSvr2.exe
C:\Program\Digital Line Detect\DLG.exe
C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program\Personal\bin\Personal.exe
C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe
C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearchIndexer.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/se/s ... efault.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.playahead.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/s ... efault.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.se/8SESVSE020100/FRWCompleteAddIns
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LÃ¤nkar
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\Program\DELADE~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar1.dll
O2 - BHO: MSNÂ Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\Program\DELADE~1\Real\Toolbar\realbar.dll
O3 - Toolbar: MSNÂ Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [diagent] C:\Program\Creative\SBLive\Diagnostics\diagent.exe startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SmcService] C:\Program\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Program\Logitech\Video\ManifestEngine.exe boot
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe
O8 - Extra context menu item: &Google Search - res://c:\program\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll/search.htm
O8 - Extra context menu item: &Translate English Word - res://c:\program\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Ã–ppna pÃ¥ ny flik i bakgrunden - res://C:\Program\MSN Toolbar Suite\TAB\02.05.0000.1105\sv-se\msntabres.dll/229?a30859911d354537aa9fe9321de28cae
O8 - Extra context menu item: Ã–ppna pÃ¥ ny flik i fÃ¶rgrunden - res://C:\Program\MSN Toolbar Suite\TAB\02.05.0000.1105\sv-se\msntabres.dll/230?a30859911d354537aa9fe9321de28cae
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\Program\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\Program\SYSTEM~1\autocomp.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program\ewido anti-malware\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program\Delade filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program\Sygate\SPF\smc.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe