Spyware Warrior

[Demented Mouse]

I followed all of the instructions in the "Victims of aurora and nail" thread and I'm here to make sure nothing else is terribly wrong with this computer. Here's my current HijackThis log and Ewido log, as instructed. There seems to be a problem with Ewido, however, when I try to get rid of the files after about 4 or 5 Ewido crashes. Thanks for your help.



Logfile of HijackThis v1.99.1
Scan saved at 9:53:57 PM, on 10/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis1991.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Spooler Subsystem] spoolsub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe





---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 9:51:49 PM, 10/10/2005
+ Report-Checksum: 9F8AA3A9

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{12FA3D1E-6BB1-A968-D251-242CE33A798A} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Classes\CLSID\{65D75D06-7395-6352-09CD-E13B9059EFE9} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{6C69E2F6-F200-55DF-18C6-3C368029FD3E} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{DCF499B3-5BE2-6F3F-B6C8-FB0597F0FF79} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{F2255AF4-092C-0BF6-52CF-8484B194FCC4} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\CLSID\{FC5F30D8-4A16-B1C4-CFF8-EE955DFA16A2} -> Spyware.CoolWebSearch : Ignored
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Ignored
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Ignored
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Ignored
C:\Program Files\Thief - Deadly Shadows\System\t3.exe -> TrojanSpy.Comcast.a : Ignored
C:\RECYCLER\NPROTECT\00102007.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102008.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102087.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102089.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00102819.exe -> Adware.BetterInternet : Ignored
C:\RECYCLER\NPROTECT\00104072.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\desktop.ini:xwvpp -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\dsr.exe -> Trojan.Imiserv.c : Ignored
C:\WINDOWS\dvfxgy.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\Greenstone.bmp:cxzxmn -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\ODBC.INI:nrboxx -> Trojan.Agent.bi : Ignored
C:\WINDOWS\Rhododendron.bmp:cflzez -> Trojan.Agent.bi : Ignored
C:\WINDOWS\setupapi.old:yysyp -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\system32:gyaa.dll -> TrojanDownloader.Small.azk : Ignored
C:\WINDOWS\system32\ajzsiic.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\system32\bddyrm.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\system32\elfvkvb.exe -> Adware.BetterInternet : Ignored
C:\WINDOWS\system32\ezPopStub.exe -> Adware.EZula : Ignored
C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Ignored
C:\WINDOWS\system32\in10tvmk37s.dll -> TrojanDropper.Small.abd : Ignored
C:\WINDOWS\system32\megaV2wbr.dll -> TrojanDropper.Small.xm : Ignored
C:\WINDOWS\system32\oleext.dll -> Trojan.Small.ev : Ignored
C:\WINDOWS\ucmoreiex.exe/UCMTSAIE.DLL -> Spyware.UCmore : Ignored
C:\WINDOWS\ucmoreiex.exe/IUCMORE.DLL -> Spyware.UCmore : Ignored
C:\WINDOWS\UPGRADE.TXT:apgco -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\vb.ini:cwehl -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\x74ca5e40.tmp:rcckgg -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default(2).pif:itkmn -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default(2).pif:jzelpl -> Spyware.SearchPage : Ignored
C:\WINDOWS\_default(2).pif:kcnpiq -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default(2).pif:oqchur -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:dwxyis -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:fqplk -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:gxhtni -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:ijdevu -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default.pif:itkmn -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:iwwdke -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default.pif:jzelpl -> Spyware.SearchPage : Ignored
C:\WINDOWS\_default.pif:kcnpiq -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:nxpntg -> Trojan.Agent.bi : Ignored
C:\WINDOWS\_default.pif:oqchur -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:qzudnx -> TrojanDownloader.Agent.bc : Ignored
C:\WINDOWS\_default.pif:uuhar -> TrojanDownloader.Agent.bq : Ignored
C:\WINDOWS\_default.pif:wagkt -> TrojanDownloader.Agent.bc : Ignored


::Report End

[Demented Mouse]

*bump* I ran Ewido again and just told it to get rid of everything, I saved backups in case any are important. I also went to another forum for a second opinion, here are the results after they got back with me.

Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 8:19:29 PM, on 10/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\HJT\HijackThis1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [ytkvkp] c:\windows\system32\rhpmni.exe r
O4 - HKLM\..\RunServices: [Spooler Subsystem] spoolsub.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe





Ewido:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:14:17 PM, 10/11/2005
+ Report-Checksum: 7B061DD1

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{12FA3D1E-6BB1-A968-D251-242CE33A798A} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{65D75D06-7395-6352-09CD-E13B9059EFE9} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{6C69E2F6-F200-55DF-18C6-3C368029FD3E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DCF499B3-5BE2-6F3F-B6C8-FB0597F0FF79} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F2255AF4-092C-0BF6-52CF-8484B194FCC4} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FC5F30D8-4A16-B1C4-CFF8-EE955DFA16A2} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID\\ -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
C:\Program Files\Thief - Deadly Shadows\System\t3.exe -> TrojanSpy.Comcast.a : Cleaned with backup
C:\RECYCLER\NPROTECT\00102007.exe -> Adware.BetterInternet : Cleaned with backup
C:\RECYCLER\NPROTECT\00102008.exe -> Adware.BetterInternet : Cleaned with backup
C:\RECYCLER\NPROTECT\00102087.exe -> Adware.BetterInternet : Cleaned with backup
C:\RECYCLER\NPROTECT\00102089.exe -> Adware.BetterInternet : Cleaned with backup
C:\RECYCLER\NPROTECT\00102819.exe -> Adware.BetterInternet : Cleaned with backup
C:\RECYCLER\NPROTECT\00104072.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\desktop.ini:xwvpp -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\dsr.exe -> Trojan.Imiserv.c : Cleaned with backup
C:\WINDOWS\dvfxgy.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:cxzxmn -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ODBC.INI:nrboxx -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\Rhododendron.bmp:cflzez -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\setupapi.old:yysyp -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32:gyaa.dll -> TrojanDownloader.Small.azk : Cleaned with backup
C:\WINDOWS\system32\ajzsiic.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\bddyrm.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\elfvkvb.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\system32\ezPopStub.exe -> Adware.EZula : Cleaned with backup
C:\WINDOWS\system32\f3PSSavr.scr -> Spyware.MyWebSearch : Cleaned with backup
C:\WINDOWS\system32\in10tvmk37s.dll -> TrojanDropper.Small.abd : Cleaned with backup
C:\WINDOWS\system32\megaV2wbr.dll -> TrojanDropper.Small.xm : Cleaned with backup
C:\WINDOWS\system32\oleext.dll -> Trojan.Small.ev : Cleaned with backup
C:\WINDOWS\ucmoreiex.exe/UCMTSAIE.DLL -> Spyware.UCmore : Cleaned with backup
C:\WINDOWS\ucmoreiex.exe/IUCMORE.DLL -> Spyware.UCmore : Cleaned with backup
C:\WINDOWS\UPGRADE.TXT:apgco -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\vb.ini:cwehl -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_default(2).pif:itkmn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_default(2).pif:jzelpl -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default(2).pif:kcnpiq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_default(2).pif:oqchur -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_default.pif:dwxyis -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_default.pif:fqplk -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_default.pif:gxhtni -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_default.pif:ijdevu -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:itkmn -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_default.pif:iwwdke -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:jzelpl -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:kcnpiq -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_default.pif:nxpntg -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:oqchur -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_default.pif:qzudnx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\_default.pif:uuhar -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\_default.pif:wagkt -> TrojanDownloader.Agent.bc : Cleaned with backup


::Report End

[CalamityJane]

Hello and apologies for missing this thread.

Are you still needing help? If so, please post a fresh HijackThis log and I will be glad to assist. I will get an automated notice when you reply so I can respond much quicker.
_________________
Microsoft MVP 2003-2008, Windows - Security