Downloader.Tibs Detection

[marti4886]

AVG picked up "Downloader.Tibs" during a scan. It was also listed in the Program Files on Zone Alarm (I have blocked access to the internet by this program from Zone Alarm).
This is my HJT report:

Logfile of HijackThis v1.99.1
Scan saved at 1:19:33 PM, on 2/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tdalearn.org:8080
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117489866312
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay102.hotmail.msn.com/activex/HMAtchmt.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[marti4886]

Sorry, the whole message didn't post. After running the HJT, I also ran an online virus scan:


Incident Status Location

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.advertising.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[www.burstbeacon.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.atwola.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.ads.addynamix.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.com.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.go.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.overture.com/]
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.target.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt[server.iad.liveperson.net/hc/73403369]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Laura\Cookies\laura@2o7[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Laura\Cookies\laura@atwola[1].txt
Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Laura\My Documents\regular_plugin-1.exe
Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Laura\My Documents\regular_plugin.exe
Potentially unwanted tool:Application/Processor Not disinfected

Rest of this scan in next post......

[marti4886]

C:\Documents and Settings\Sheri\Desktop\Unused Desktop Shortcuts\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Potentially unwanted tool:Application/Leaktest.A Not disinfected C:\Documents and Settings\Sheri\My Documents\PC Utilities & Setup\leaktest.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Sheri\My Documents\PC Utilities & Setup\SmitfraudFix\Process.exe
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.advertising.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[server.iad.liveperson.net/hc/46445258]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[server.iad.liveperson.net/hc/46445258]
Spyware:Cookie/OfferOptimizer Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.offeroptimizer.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[citi.bridgetrack.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.go.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt[.maxserving.com/]
Adware:Adware/IST.YourSiteBar Not disinfected C:\WINDOWS\Downloaded Program Files\YSBactivex.inf

Do I still have 'bad stuff' on my system? How do I get rid of it?

Thanks

[pskelley]

Welcome to the forum, thanks for posting that information. I see you are storing a lot of junk cookies, if you need help with that use this information:
http://privacy.getnetwise.org/browsing/tools/firefox1/ffdisablecookies
http://www.mozilla.org/projects/security/pki/psm/help_21/using_priv_help.html

You also have an old Smitfraudfix program on the Desktop, delete it. It must be downloaded fresh if ever needed again. Are you sure you are clean of Smitfraud?

Your Java program is out of date, see this information:
http://forums.spybot.info/showpost.php?p=12880&postcount=2
C:\Program Files\Java\jre1.5.0_06\ <<< out of date, download the newest version and uninstall all old version in Add Remove Programs.

You do have junk that was not removed by the scan, let's do this:

Please download ATF Cleaner by Atribune
http://www.atribune.org/content/view/25/2/
Save it to your Desktop. We will use this later.

SpywareGuard may block out change, click the SG in the System Tray, then click Files > Exit. It will be put back after a restart.

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -
Netster adware

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Follow the directions in this link, make sure you delete or at least quarantine anything located and save the scan report, I must see it.
http://forums.security-central.us/showthread.php?t=3165

Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

Restart the computer and post the scan report results from AVG Anti-Spyware, a new HJT log and any comments you think will help. How is the computer running.

Thanks

[marti4886]

Thanks for your answer, sorry about the delay, it's taken me until today to find the time to carry out your instructions. Since my last post, AVG virus scan had picked up two new versions of the Downloader.Tibs, both located in my System Volume Information folder. I disconnected the computer from the internet and haven't used until today.

I performed all your recommended actions (thanks a lot for all the info!) and here are my reports:

Logfile of HijackThis v1.99.1
Scan saved at 2:17:57 PM, on 2/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tdalearn.org:8080
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117489866312
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay102.hotmail.msn.com/activex/HMAtchmt.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Second report (AVG AntiSpyware) to follow

[marti4886]

here's AVG AntiSpyware report:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 1:55:56 PM 2/10/2007

+ Scan result:



C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : No action taken.
C:\Documents and Settings\Laura\My Documents\regular_plugin-1.exe -> Downloader.INService.ja : No action taken.
C:\Documents and Settings\Laura\My Documents\regular_plugin.exe -> Downloader.INService.ja : No action taken.
:mozilla.287:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.247realmedia : No action taken.
:mozilla.10:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.23:C:\Documents and Settings\Emily\Application Data\Mozilla\Firefox\Profiles\iun8w6mz.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.7:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.89:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.8:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.90:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.91:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.92:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.93:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.94:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.95:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.9:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Laura\Cookies\laura@2o7[1].txt -> TrackingCookie.2o7 : No action taken.
:mozilla.189:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.190:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.312:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Addynamix : No action taken.
:mozilla.52:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.53:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.54:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.55:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.56:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.57:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Adrevolver : No action taken.
:mozilla.58:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.59:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.59:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.60:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.60:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.61:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.62:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.62:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.63:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.39:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.7:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.255:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Bluestreak : No action taken.
:mozilla.163:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Bridgetrack : No action taken.
:mozilla.164:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Bridgetrack : No action taken.
:mozilla.262:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Burstbeacon : No action taken.
:mozilla.136:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.137:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.259:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.260:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.261:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.139:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.140:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.141:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.142:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.143:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.144:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.48:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.49:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.50:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.269:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.270:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.329:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.330:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.331:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.497:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.485:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Cqcounter : No action taken.
:mozilla.35:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.61:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.108:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.109:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.110:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.111:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.130:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.131:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.132:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.133:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.134:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.47:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.534:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.535:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.536:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.537:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.171:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.172:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.173:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.174:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.175:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.503:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.504:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.72:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.73:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.74:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Liveperson : No action taken.
:mozilla.268:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Masterstats : No action taken.
:mozilla.114:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.192:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.

....more in next post......

[marti4886]

:mozilla.193:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.406:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.171:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.172:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.173:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.174:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.175:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.88:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.89:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.90:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.91:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.165:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.166:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.167:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.123:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Realmedia : No action taken.
:mozilla.124:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Realmedia : No action taken.
:mozilla.125:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Realmedia : No action taken.
:mozilla.67:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Realmedia : No action taken.
:mozilla.68:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Realmedia : No action taken.
:mozilla.69:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Realmedia : No action taken.
:mozilla.343:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.344:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.345:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.346:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.347:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.79:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.92:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.93:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.94:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.95:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.549:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.550:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.551:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.310:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Specificclick : No action taken.
:mozilla.311:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Specificclick : No action taken.
:mozilla.360:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.361:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.508:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.266:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.267:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.145:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.146:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.147:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.148:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.490:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.271:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.32:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.33:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.37:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.40:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.41:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.42:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.43:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.45:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.46:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.47:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.458:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Trafic : No action taken.
:mozilla.31:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.64:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.32:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.33:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.34:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.35:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.36:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.38:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.39:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.44:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.45:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.46:C:\Documents and Settings\Timmo\Application Data\Mozilla\Firefox\Profiles\uvoor1mx.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.152:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.153:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.154:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.155:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.156:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.158:C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\tzmsm9kb.default\cookies.txt -> TrackingCookie.Zedo : No action taken.


::Report end

Are things getting better? Thanks for all your help, I really appreciate it!

[pskelley]

System Volume is your System Restore files and we will clean those before we are done, just do not do a System Restore or the junk will get back on the computer.

Here were my instructions fro running AVG Anti-Spyware:

Follow the directions in this link, make sure you delete or at least quarantine anything located and save the scan report, I must see it.http://forums.security-central.us/showthread.php?t=3165

every item in the scan report you posted says this: No action taken

Please run it again and follow the directions in the link to delete or at least quarantine what is located. Post a new scan report then reboot and post a new HJT log.

I do not need to see all of those cookies again, edit them out of the scan report, just be sure they say DELETED.


Thanks

[marti4886]

Sorry for the mixup, I thought you wanted to see the entire report. I did delete all entries, just posted report displayed prior to taking any action, my bad. A repeat scan this morning found no threats, so there is nothing to post from AVG AS. Here is the new HJT report:

Logfile of HijackThis v1.99.1
Scan saved at 10:47:06 AM, on 2/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.tdalearn.org:8080
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117489866312
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by102fd.bay102.hotmail.msn.com/activex/HMAtchmt.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Again, thanks for your help.

[pskelley]

No biggie, I just want this junk off your computer, probably as bad as you do. Everything looks good and if you have no issues I would say you are good to go. Let's finish up like this:
System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?Open&src=sec_doc_nam

If you have not updated your antivirus protection and are going to continue with Grisoft, I think the last day for 7.1 is 2/18/2007, see this information:
http://free.grisoft.com/doc/5390/lng/us/tpl/v5

AVG Anti-Spyware is a good program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[marti4886]

psk:

thanks so much for all your help, I try and keep my machine as clean as possible, but I had activated cookies to visit a site and forgot to block them after I was done. Also, I do run and keep updated: AVG AV, Spybot S&D, Cleanup, CCcleaner, SpywareBlaster, ZoneAlarm, and probably more I can't remember right now. Once a week I totally clean everything up, takes about an hour, but has worked for me for over 6 years. Problem is, I have teenagers......who thought that if they used Opera to look for free porn I would never know......that was how all this gunk got here in the first place. I have probably had a zillion conversations with them about seeking out free porn, both as a mom that really finds this content distasteful and generally not good for young minds, and also from the standpoint that the whole world of online porn is a mindfield of malicious stuff that will turn one's pc to trash in a heartbeat. I have obviously taken some corrective measures to keep the kiddos off the pc until I know they will be more responsible. Cleaning up the stuff on here has taken a lot of time, and I don't want a repeat.

I will spend some time reading the links you've provide, they all are very informative (I've glanced through them) and again I thank you.