Here are the 3 logs as requested - Thanks again !
Spysweeper:
08:09: Removal process completed. Elapsed time 00:00:39
08:08: Quarantining All Traces: aa cookie
08:08: Quarantining All Traces: screensavers.com cookie
08:08: Quarantining All Traces: www.mature-post cookie
08:08: Quarantining All Traces: frenchcum cookie
08:08: Quarantining All Traces: passion cookie
08:08: Quarantining All Traces: starware.com cookie
08:08: Quarantining All Traces: adjuggler cookie
08:08: Quarantining All Traces: mrskin cookie
08:08: Quarantining All Traces: monstermarketplace cookie
08:08: Quarantining All Traces: myaffiliateprogram.com cookie
08:08: Quarantining All Traces: 123count cookie
08:08: Quarantining All Traces: bs.serving-sys cookie
08:08: Quarantining All Traces: tradedoubler cookie
08:08: Quarantining All Traces: adtech cookie
08:08: Quarantining All Traces: about cookie
08:08: Quarantining All Traces: goldenpalace cookie
08:08: Quarantining All Traces: overture cookie
08:08: Quarantining All Traces: sexsearch cookie
08:08: Quarantining All Traces: advertising cookie
08:08: Quarantining All Traces: a cookie
08:08: Quarantining All Traces: yieldmanager cookie
08:08: Quarantining All Traces: wegcash cookie
08:08: Quarantining All Traces: serving-sys cookie
08:08: Quarantining All Traces: xren_cj cookie
08:08: Quarantining All Traces: topfivesearch cookie
08:08: Quarantining All Traces: zango cookie
08:08: Quarantining All Traces: questionmarket cookie
08:08: Quarantining All Traces: moviemonster cookie
08:08: Quarantining All Traces: cassava cookie
08:08: Quarantining All Traces: atlas dmt cookie
08:08: Quarantining All Traces: mediaplex cookie
08:08: Quarantining All Traces: webservicehosts cookie
08:08: Quarantining All Traces: clicktracks cookie
08:08: Quarantining All Traces: metareward.com cookie
08:08: Quarantining All Traces: domain sponsor cookie
08:08: Quarantining All Traces: nuker cookie
08:08: Quarantining All Traces: esurance cookie
08:08: Quarantining All Traces: reliablestats cookie
08:08: Quarantining All Traces: tracking cookie
08:08: Quarantining All Traces: eroticy cookie
08:08: Quarantining All Traces: yadro cookie
08:08: Quarantining All Traces: customer cookie
08:08: Quarantining All Traces: ccbill cookie
08:08: Quarantining All Traces: clickzs cookie
08:08: Quarantining All Traces: herfirstlesbiansex cookie
08:08: Quarantining All Traces: kinghost cookie
08:08: Quarantining All Traces: web-stat cookie
08:08: Quarantining All Traces: bpath cookie
08:08: Quarantining All Traces: searchadnetwork cookie
08:08: Quarantining All Traces: search123 cookie
08:08: Quarantining All Traces: adshooter cookie
08:08: Quarantining All Traces: touchclarity cookie
08:08: Quarantining All Traces: epilot cookie
08:08: Quarantining All Traces: infospace cookie
08:08: Quarantining All Traces: ic-live cookie
08:08: Quarantining All Traces: 2o7.net cookie
08:08: Quarantining All Traces: associated new media cookie
08:08: Quarantining All Traces: mediapipe
08:08: Quarantining All Traces: desktoptraffic
08:08: Quarantining All Traces: topsearch
08:08: Quarantining All Traces: searchrelevancy
08:08: Quarantining All Traces: instant access
08:08: Quarantining All Traces: blazefind_adman
08:08: Quarantining All Traces: targetsaver
08:08: Quarantining All Traces: coolwebsearch (cws)
08:08: Quarantining All Traces: begin2search
08:08: Quarantining All Traces: fastvideoplayer
08:08: Quarantining All Traces: cws-aboutblank
08:08: Removal process initiated
08:07: The Internet Communication shield has blocked access to:
WWW.AMAENA.COM
07:48: ApplicationMinimized - EXIT
07:48: ApplicationMinimized - EXIT
07:48: ApplicationMinimized - ENTER
07:48: ApplicationMinimized - ENTER
07:48: IE Security Shield: found: C:\PROGRAM FILES\AOL 9.0D\WAOL.EXE -- IE
Security modification denied
07:36: ApplicationMinimized - EXIT
07:36: ApplicationMinimized - EXIT
07:36: ApplicationMinimized - ENTER
07:36: ApplicationMinimized - ENTER
07:36: IE Security Shield: found: C:\PROGRAM FILES\AOL 9.0D\WAOL.EXE -- IE
Security modification denied
07:35: ApplicationMinimized - EXIT
07:35: ApplicationMinimized - EXIT
07:35: ApplicationMinimized - ENTER
07:35: ApplicationMinimized - ENTER
07:23: IE Security Shield: found: C:\PROGRAM FILES\AOL 9.0D\WAOL.EXE -- IE
Security modification denied
18:43: IE Security Shield: found: C:\PROGRAM FILES\AOL 9.0D\WAOL.EXE -- IE
Security modification denied
18:42: ApplicationMinimized - EXIT
18:42: ApplicationMinimized - EXIT
18:42: ApplicationMinimized - ENTER
18:42: ApplicationMinimized - ENTER
17:16: Traces Found: 120
17:16: Full Sweep has completed. Elapsed time 00:25:14
17:16: File Sweep Complete, Elapsed Time: 00:20:31
17:13: Warning: SweepDirectories: Cannot find directory "i:". This
directory was not added to the list of paths to be scanned.
17:13: Warning: SweepDirectories: Cannot find directory "h:". This
directory was not added to the list of paths to be scanned.
17:13: Warning: SweepDirectories: Cannot find directory "g:". This
directory was not added to the list of paths to be scanned.
17:13: Warning: SweepDirectories: Cannot find directory "f:". This
directory was not added to the list of paths to be scanned.
17:13: Warning: SweepDirectories: Cannot find directory "e:". This
directory was not added to the list of paths to be scanned.
17:13: Warning: SweepDirectories: Cannot find directory "d:". This
directory was not added to the list of paths to be scanned.
17:13: Error: Access violation at address 77C47FD4 in module 'msvcrt.dll'.
Read of address 05C20000.
17:07: Warning: Failed to open file "c:\documents and settings\g
kelly\local settings\application data\microsoft\windows\usrclass.dat". The
process cannot access the file because it is being used by another process
17:07: Warning: Failed to open file "c:\documents and settings\g
kelly\local settings\application data\microsoft\windows\usrclass.dat.log".
The process cannot access the file because it is being used by another
process
17:06: Warning: Failed to open file "c:\documents and settings\g
kelly\ntuser.dat". The process cannot access the file because it is being
used by another process
17:06: Warning: Failed to open file "c:\documents and settings\g
kelly\ntuser.dat.log". The process cannot access the file because it is
being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\localservice\application data\webroot\spy
sweeper\data\settings.dat". The process cannot access the file because it is
being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\localservice\local settings\application
data\microsoft\windows\usrclass.dat". The process cannot access the file
because it is being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\localservice\local settings\application
data\microsoft\windows\usrclass.dat.log". The process cannot access the file
because it is being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\localservice\ntuser.dat". The process cannot access the file
because it is being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\localservice\ntuser.dat.log". The process cannot access the file
because it is being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\networkservice\local settings\application
data\microsoft\windows\usrclass.dat". The process cannot access the file
because it is being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\networkservice\local settings\application
data\microsoft\windows\usrclass.dat.log". The process cannot access the file
because it is being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\networkservice\ntuser.dat". The process cannot access the file
because it is being used by another process
17:06: Warning: Failed to open file "c:\documents and
settings\networkservice\ntuser.dat.log". The process cannot access the file
because it is being used by another process
17:01: Warning: Failed to open file
"c:\windows\softwaredistribution\eventcache\{1e80db8a-9232-435e-9372-64b2ebd24d79}.bin".
The process cannot access the file because it is being used by another
process
17:00: c:\windows\downloaded program files\fastvideoplayer.inf (ID =
60913)
16:59: C:\WINDOWS\inf\fastvideoplayer.inf (ID = 60913)
16:58: C:\WINDOWS\system32\cache32_gpstool (1 subtraces) (ID = 2147519835)
16:57: Warning: Failed to open file "c:\windows\system32\config\sam". The
process cannot access the file because it is being used by another process
16:57: Warning: Failed to open file "c:\windows\system32\config\system".
The process cannot access the file because it is being used by another
process
16:57: Warning: Failed to open file "c:\windows\system32\config\software".
The process cannot access the file because it is being used by another
process
16:57: Warning: Failed to open file "c:\windows\system32\config\security".
The process cannot access the file because it is being used by another
process
16:57: Warning: Failed to open file "c:\windows\system32\config\default".
The process cannot access the file because it is being used by another
process
16:57: Warning: Failed to open file
"c:\windows\system32\config\security.log". The process cannot access the
file because it is being used by another process
16:57: Warning: Failed to open file "c:\windows\system32\config\sam.log".
The process cannot access the file because it is being used by another
process
16:57: Warning: Failed to open file
"c:\windows\system32\config\default.log". The process cannot access the file
because it is being used by another process
16:57: Warning: Failed to open file
"c:\windows\system32\config\software.log". The process cannot access the
file because it is being used by another process
16:57: Warning: Failed to open file
"c:\windows\system32\config\system.log". The process cannot access the file
because it is being used by another process
16:57: C:\WINDOWS\system32\kas pink123312.ico (ID = 51041)
16:57: C:\WINDOWS\system32\kas pink12331.ico (ID = 51041)
16:57: C:\WINDOWS\system32\eg_auth_srv_1044.dll (ID = 134777)
16:56: C:\WINDOWS\system32\moviesgreen.ico (ID = 51033)
16:56: C:\WINDOWS\system32\moviesgreen1.ico (ID = 51033)
16:56: C:\WINDOWS\system32\eaffiliate2.exe (ID = 78230)
16:56: Found Adware: targetsaver
16:56: C:\WINDOWS\p2esocks_1044.dll (ID = 134777)
16:55: Warning: Failed to open file "c:\pagefile.sys". Access is denied
16:55: Warning: Failed to open file "c:\hiberfil.sys". Access is denied
16:55: Starting File Sweep
16:55: Warning: SweepDirectories: Cannot find directory "a:". This directory
was not added to the list of paths to be scanned.
16:55: Cookie Sweep Complete, Elapsed Time: 00:00:14
16:55: c:\documents and settings\g kelly\cookies\g
kelly@i.screensavers[2].txt (ID = 3298)
16:55: c:\documents and settings\g kelly\cookies\g kelly@aa[2].txt (ID =
2029)
16:55: Found Spy Cookie: aa cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.screensavers[1].txt (ID = 3298)
16:55: Found Spy Cookie: screensavers.com cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.mature-post[1].txt (ID = 3703)
16:55: Found Spy Cookie: www.mature-post cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@yieldmanager[2].txt (ID = 3749)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.frenchcum[1].txt (ID = 2707)
16:55: Found Spy Cookie: frenchcum cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@stats1.reliablestats[1].txt (ID = 3254)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@tour.splash.sexsearch[2].txt (ID = 3358)
16:55: c:\documents and settings\g kelly\cookies\g kelly@passion[2].txt
(ID = 3113)
16:55: Found Spy Cookie: passion cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@yadro[2].txt (ID
= 3743)
16:55: c:\documents and settings\g kelly\cookies\g kelly@customer[2].txt
(ID = 2481)
16:55: c:\documents and settings\g kelly\cookies\g kelly@h.starware[1].txt
(ID = 3442)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@try.starware[1].txt (ID = 3442)
16:55: Found Spy Cookie: starware.com cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@rotator.adjuggler[1].txt (ID = 2071)
16:55: Found Spy Cookie: adjuggler cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@www.mrskin[1].txt
(ID = 3021)
16:55: Found Spy Cookie: mrskin cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@free.wegcash[3].txt (ID = 3682)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.monstermarketplace[2].txt (ID = 3007)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@monstermarketplace[1].txt (ID = 3006)
16:55: Found Spy Cookie: monstermarketplace cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@kinghost[1].txt
(ID = 2903)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.myaffiliateprogram[1].txt (ID = 3032)
16:55: Found Spy Cookie: myaffiliateprogram.com cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@ford.touchclarity[3].txt (ID = 3566)
16:55: c:\documents and settings\g kelly\cookies\g kelly@infospace[1].txt
(ID = 2865)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@promo.moviemonster[3].txt (ID = 3011)
16:55: c:\documents and settings\g kelly\cookies\g kelly@ccbill[2].txt (ID
= 2369)
16:55: c:\documents and settings\g kelly\cookies\g kelly@123count[2].txt
(ID = 1927)
16:55: Found Spy Cookie: 123count cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@bs.serving-sys[1].txt (ID = 2330)
16:55: Found Spy Cookie: bs.serving-sys cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@tradedoubler[2].txt (ID = 3575)
16:55: Found Spy Cookie: tradedoubler cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@digitalclarity.112.2o7[1].txt (ID = 1958)
16:55: c:\documents and settings\g kelly\cookies\g kelly@adtech[2].txt (ID
= 2155)
16:55: Found Spy Cookie: adtech cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@overture[2].txt
(ID = 3105)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@metals.about[1].txt (ID = 2038)
16:55: Found Spy Cookie: about cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@goldenpalace[1].txt (ID = 2734)
16:55: Found Spy Cookie: goldenpalace cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@aoleusearch.122.2o7[1].txt (ID = 1958)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@aol.touchclarity[1].txt (ID = 3566)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@data3.perf.overture[2].txt (ID = 3106)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@data2.perf.overture[1].txt (ID = 3106)
16:55: Found Spy Cookie: overture cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@btow.touchclarity[1].txt (ID = 3566)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@tour.splash.sexsearch[1].txt (ID = 3358)
16:55: Found Spy Cookie: sexsearch cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@advertising[1].txt (ID = 2175)
16:55: Found Spy Cookie: advertising cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@a[3].txt (ID =
2027)
16:55: Found Spy Cookie: a cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@ad.yieldmanager[1].txt (ID = 3751)
16:55: Found Spy Cookie: yieldmanager cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@free.wegcash[1].txt (ID = 3682)
16:55: Found Spy Cookie: wegcash cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@xren_cj[3].txt
(ID = 3723)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@serving-sys[1].txt (ID = 3343)
16:55: Found Spy Cookie: serving-sys cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@stats1.reliablestats[3].txt (ID = 3254)
16:55: c:\documents and settings\g kelly\cookies\g kelly@xren_cj[1].txt
(ID = 3723)
16:55: Found Spy Cookie: xren_cj cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@ws1.topfivesearch[1].txt (ID = 3556)
16:55: Found Spy Cookie: topfivesearch cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@ford.touchclarity[1].txt (ID = 3566)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@theaa.touchclarity[1].txt (ID = 3566)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@cz8.clickzs[1].txt (ID = 2413)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@cz4.clickzs[2].txt (ID = 2413)
16:55: c:\documents and settings\g kelly\cookies\g kelly@lp.zango[1].txt
(ID = 3761)
16:55: Found Spy Cookie: zango cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@questionmarket[1].txt (ID = 3217)
16:55: Found Spy Cookie: questionmarket cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@promo.moviemonster[2].txt (ID = 3011)
16:55: Found Spy Cookie: moviemonster cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@cassava[1].txt
(ID = 2362)
16:55: Found Spy Cookie: cassava cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@atdmt[2].txt (ID
= 2253)
16:55: Found Spy Cookie: atlas dmt cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.web-stat[2].txt (ID = 3649)
16:55: c:\documents and settings\g kelly\cookies\g kelly@mediaplex[1].txt
(ID = 6442)
16:55: Found Spy Cookie: mediaplex cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@apps.webservicehosts[1].txt (ID = 3663)
16:55: Found Spy Cookie: webservicehosts cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@stats.clicktracks[1].txt (ID = 2407)
16:55: Found Spy Cookie: clicktracks cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@metareward[2].txt
(ID = 2990)
16:55: Found Spy Cookie: metareward.com cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@searchportal.domainsponsor[1].txt (ID = 2534)
16:55: Found Spy Cookie: domain sponsor cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@nuker[1].txt (ID
= 3085)
16:55: Found Spy Cookie: nuker cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.esurance[1].txt (ID = 2626)
16:55: Found Spy Cookie: esurance cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@stats1.reliablestats[2].txt (ID = 3254)
16:55: Found Spy Cookie: reliablestats cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@tracking[1].txt
(ID = 3571)
16:55: Found Spy Cookie: tracking cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.eroticy[2].txt (ID = 2624)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@aflmanager.eroticy[1].txt (ID = 2624)
16:55: Found Spy Cookie: eroticy cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@yadro[1].txt (ID
= 3743)
16:55: Found Spy Cookie: yadro cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@customer[1].txt
(ID = 2481)
16:55: Found Spy Cookie: customer cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@ccbill[1].txt (ID
= 2369)
16:55: Found Spy Cookie: ccbill cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@msnportal.112.2o7[1].txt (ID = 1958)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@cz9.clickzs[1].txt (ID = 2413)
16:55: Found Spy Cookie: clickzs cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@herfirstlesbiansex[2].txt (ID = 2771)
16:55: Found Spy Cookie: herfirstlesbiansex cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@kinghost[2].txt
(ID = 2903)
16:55: Found Spy Cookie: kinghost cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@server3.web-stat[1].txt (ID = 3649)
16:55: Found Spy Cookie: web-stat cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@ads18.bpath[1].txt (ID = 2321)
16:55: Found Spy Cookie: bpath cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.searchadnetwork[2].txt (ID = 3312)
16:55: c:\documents and settings\g kelly\cookies\g
kelly@searchadnetwork[2].txt (ID = 3311)
16:55: Found Spy Cookie: searchadnetwork cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@search123[1].txt
(ID = 3305)
16:55: Found Spy Cookie: search123 cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@www.adshooter[1].txt (ID = 2150)
16:55: Found Spy Cookie: adshooter cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@partypoker.touchclarity[1].txt (ID = 3567)
16:55: Found Spy Cookie: touchclarity cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@www.epilot[1].txt
(ID = 2622)
16:55: Found Spy Cookie: epilot cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@infospace[2].txt
(ID = 2865)
16:55: Found Spy Cookie: infospace cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@ic-live[1].txt
(ID = 2821)
16:55: Found Spy Cookie: ic-live cookie
16:55: c:\documents and settings\g kelly\cookies\g
kelly@aoluk.122.2o7[1].txt (ID = 1958)
16:55: Found Spy Cookie: 2o7.net cookie
16:55: c:\documents and settings\g kelly\cookies\g kelly@anm.co[1].txt (ID
= 2223)
16:55: Found Spy Cookie: associated new media cookie
16:55: Starting Cookie Sweep
16:55: Registry Sweep Complete, Elapsed Time:00:00:27
16:55:
HKU\S-1-5-21-1444379218-3236771260-3160248370-1006\software\microsoft\windows\currentversion\ext\stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6}\
(ID = 1922744)
16:55: Found Adware: coolwebsearch (cws)
16:55:
HKU\S-1-5-21-1444379218-3236771260-3160248370-1006\software\microsoft\windows\currentversion\run\
|| license manager (ID = 1329789)
16:55: Found Adware: mediapipe
16:55:
HKU\S-1-5-21-1444379218-3236771260-3160248370-1006\software\microsoft\internet
explorer\main\ || search page_bak (ID = 774883)
16:55: HKU\S-1-5-21-1444379218-3236771260-3160248370-1006\software\_gwss\
(ID = 639269)
16:55: Found Adware: begin2search
16:55: HKU\S-1-5-21-1444379218-3236771260-3160248370-1006\eeennn\ (ID =
124993)
16:55: Found Adware: desktoptraffic
16:55:
HKU\S-1-5-21-1444379218-3236771260-3160248370-1006\software\microsoft\internet
explorer\main\ || search page_bak (ID = 115925)
16:55:
HKU\S-1-5-21-1444379218-3236771260-3160248370-1006\software\microsoft\internet
explorer\main\ || search bar_bak (ID = 115924)
16:55: Found Adware: cws-aboutblank
16:55: HKLM\software\topmoxie\topsearch\ (ID = 1180367)
16:55: Found Adware: topsearch
16:55: HKLM\software\classes\clsid\{ba749bc1-143e-430d-b1da-1d2af67a3658}\
(ID = 1030417)
16:55: HKCR\clsid\{ba749bc1-143e-430d-b1da-1d2af67a3658}\ (ID = 1030412)
16:55: HKLM\software\classes\clsid\{b2b0aedf-7cdf-4792-bb67-7654ad1e1b13}\
(ID = 888971)
16:55: HKCR\clsid\{b2b0aedf-7cdf-4792-bb67-7654ad1e1b13}\ (ID = 888967)
16:55: HKLM\software\searchrelevancy\ (ID = 141300)
16:55: HKLM\software\microsoft\windows\currentversion\uninstall\search
relevancy\ (ID = 141299)
16:55: Found Adware: searchrelevancy
16:55: HKLM\software\classes\clsid\{31ddc1fd-cea3-4837-a6dc-87e67015adc9}\
(ID = 128730)
16:55: HKCR\clsid\{31ddc1fd-cea3-4837-a6dc-87e67015adc9}\ (ID = 128678)
16:55: Found Adware: instant access
16:55: HKLM\software\classes\fastvideoplayer.fastvideoplayerctrl\ (ID =
126423)
16:55: HKLM\software\classes\fastvideoplayer.fastvideoplayerctrl.1\ (ID =
126422)
16:55: HKCR\fastvideoplayer.fastvideoplayerctrl\ (ID = 126416)
16:55: HKCR\fastvideoplayer.fastvideoplayerctrl.1\ (ID = 126415)
16:55: Found Trojan Horse: fastvideoplayer
16:55: HKLM\software\microsoft\windows\currentversion\shareddlls\ ||
c:\windows\downloaded program files\admanctlx.dll (ID = 104583)
16:55:
HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded
program files/admanctlx.dll\ (ID = 104581)
16:55: Found Adware: blazefind_adman
16:55: Starting Registry Sweep
16:55: Memory Sweep Complete, Elapsed Time: 00:03:47
16:51: Starting Memory Sweep
16:51: Start Full Sweep
16:51: Sweep initiated using definitions version 894
16:49: ApplicationMinimized - EXIT
16:49: ApplicationMinimized - ENTER
16:49: ApplicationMinimized - EXIT
16:49: ApplicationMinimized - ENTER
16:49: ApplicationMinimized - EXIT
16:49: ApplicationMinimized - ENTER
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: Off
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
16:47: Shield States
16:47: Spyware Definitions: 894
16:47: Spy Sweeper 5.3.2.2361 started
16:47: Spy Sweeper 5.3.2.2361 started
16:47: | Start of Session, 11 April 2007 |
***************
Kaspersky:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 12, 2007 12:19:50 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 12/04/2007
Kaspersky Anti-Virus database records: 296174
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
Scan Statistics:
Total number of scanned objects: 73171
Number of viruses found: 9
Number of infected objects: 17 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:11:53
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\Agent.dll Infected: Trojan.Win32.Agent.qg skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\variable Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\ph Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\storage\stdout.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\storage\stderr.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\storage\server.lock Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\storage\cache.db Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\main.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\sap.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\sysnews.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\STYLE.LST Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\Toolbar.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\Apps.Lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\spool.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\idb\Diction.lst Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\organize\kwbltdu5b Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\organize\CACHE\kwbltdu01 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\organize\kwbltdu5b.aby Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\organize\kwbltdu5b.abi Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\ShopAssist\DataStore\users\Kwbltdu5b.adb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\AOL\C_AOL 9.0d\ShopAssist\DataStore\global\clientcache.adb Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\G Kelly\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\G Kelly\Local Settings\Temp\temp.fr212B\license_manager.exe Infected: Trojan.Win32.Agent.qg skipped
C:\Documents and Settings\G Kelly\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\G Kelly\Local Settings\History\History.IE5\MSHist012007041220070413\index.dat Object is locked skipped
C:\Documents and Settings\G Kelly\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\G Kelly\Local Settings\Temporary Internet Files\Content.IE5\AN3J8RO5\WinAntiVirusPro2007FreeInstall[1].cab/UWA7P_0001_N91M0809NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped
C:\Documents and Settings\G Kelly\Local Settings\Temporary Internet Files\Content.IE5\AN3J8RO5\WinAntiVirusPro2007FreeInstall[1].cab CAB: infected - 1 skipped
C:\Documents and Settings\G Kelly\Local Settings\Temporary Internet Files\Content.IE5\J5V8QY4L\WinAntiVirusPro2007FreeInstall[1].exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped
C:\Documents and Settings\G Kelly\Local Settings\Temporary Internet Files\Content.IE5\J5V8QY4L\Install-Errorprotector-Free[1].exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\Documents and Settings\G Kelly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\G Kelly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\G Kelly\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\G Kelly\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\G Kelly\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\G Kelly\ntuser.dat Object is locked skipped
C:\Program Files\RebateNation4\RebateNation.exe Infected: not-a-virus:AdTool.Win32.WebRebates.r skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.mst Object is locked skipped
C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP678\A0146613.exe Infected: not-a-virus:AdWare.Win32.NaviPromo.gen skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP719\A0156107.exe/WISE0007.BIN Infected: Trojan-Downloader.Win32.TSUpdate.e skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP719\A0156107.exe WiseSFX: infected - 1 skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP719\A0156108.dll Infected: Trojan.Win32.P2E.ce skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP719\A0156109.dll Infected: Trojan.Win32.P2E.ce skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP707\A0154326.exe Infected: Trojan.Win32.Agent.qg skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP708\A0154454.exe/data0002 Infected: not-a-virus:AdWare.Win32.Comet.ac skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP708\A0154454.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP709\A0154607.exe Infected: not-a-virus:AdWare.Win32.NaviPromo.gen skipped
C:\System Volume Information\_restore{C39DF4B0-C3CF-475F-9C39-C9F173F17665}\RP720\change.log Object is locked skipped
Scan process completed.
Hijack this:
Logfile of HijackThis v1.99.1
Scan saved at 12:23:02, on 12/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\AOL\1133206603\ee\AOLSoftware.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
C:\Program Files\AOL 9.0d\aoltray.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
c:\program files\common files\aol\1133206603\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\program files\common files\aol\1133206603\ee\aolsoftware.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ws1.appswebservice.com/index.php?tp...44&ttid=104R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AOLDialer] "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"
O4 - HKLM\..\Run: [Omnipage] "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] "C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe" icon
O4 - HKLM\..\Run: [DSLAGENTEXE] "C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe"
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [as4Sb] C:\WINDOWS\qsyhpv.exe
O4 - HKLM\..\Run: [Á³# L"h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\qsyhpv.exe
O4 - HKLM\..\Run: [clwjuhsj] C:\WINDOWS\clwjuhsj.exe
O4 - HKLM\..\Run: [RebateNation] "C:\Program Files\RebateNation4\RebateNation.exe"
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1133206603\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [kwzr] C:\PROGRA~1\COMMON~1\kwzr\kwzrm.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0d\aoltray.exe
O4 - Global Startup: AOL Broadband Check-Up.lnk = C:\Program Files\AOL\Broadband CheckUp\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Rebate Nation. - file://C:\Program Files\RebateNation4\rebatesnation\rebatetnation\rebnC0.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.supanet.com/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cabO16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) -
http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cabO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
http://download.av.aolsvc.co.uk/molbin/sha...84/mcinsctl.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat...b?1145640398375O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) -
https://flashcasino.ladbrokes.com/instant-p...-en/FlashAX.cabO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/...509/mcfscan.cabO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Cheers !
