SVZ-Host was found in my computer

[Hates Viruses]

Hello, first of all I wanted to say what a great site this is....extremely helpful!

I followed all steps, but I had a question regarding the "SpyBot S*D"
I had some files that were Microsoft(it said the security system had been disabled ect.), HKEY, Wild Tangent, and they were infected...so I wasnt sure to push the "Fix it" button because it said it would remove items...and I didn't wan't to crash my hardrive by removing them, so any help on that is appreciated.

Now to the main problem at hand. I was looking through my windows, and found this little "SVZ host," I guess trying to pose as the "SVC host," so I quickly went into safe mode, and deleted it, but then doing further research on it I found out "SVZhost" makes a phony duplicate of a windows update and then installs it more malaware....so I'm pretty sure I downloaded it thinking it was a real update...but when I saw the "SVZhost" I made sure to see when it was created..which was on April 3rd..so I deleted all of the windows update created on April 3...so now I'm here.

(HJT)
Logfile of HijackThis v1.99.1
Scan saved at 5:00:12 AM, on 4/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\svzhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\JAMESS~1\LOCALS~1\Temp\Rar$EX00.047\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [supdate] C:\WINDOWS\System32\IEXPL0RER.exe
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Windows Process] "C:\WINDOWS\system32\win_update.exe"
O4 - HKCU\..\Run: [Win32 Process Host] "C:\WINDOWS\svzhost.exe"
O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Uniblue\Registry Booster\RegistryBooster.exe /S
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06071909/qsp2ie06071909.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe




.

[Hates Viruses]

(The Active Scan)


Incident Status Location

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[ad.yieldmanager.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.atdmt.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.advertising.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.doubleclick.net/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.realmedia.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.trafficmp.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.statcounter.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.overture.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.tribalfusion.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.adrevolver.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.bs.serving-sys.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.yadro.ru/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.zedo.com/]
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.revenue.net/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[searchportal.information.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.adultfriendfinder.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.hitbox.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.ads.pointroll.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.as-eu.falkag.net/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.xiti.com/]
Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.sexlist.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.perf.overture.com/]
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.cs.sexcounter.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.2o7.net/]
Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[stat.onestat.com/]
Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.hotlog.ru/]
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies-1.txt[.com.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.as-us.falkag.net/]

[Hates Viruses]

The Second half of the Active

Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.overture.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.go.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.com.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[citi.bridgetrack.com/]
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.revenue.net/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[searchportal.information.com/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[counter.hitslink.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.cs.sexcounter.com/]
Spyware:Cookie/SexList Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.sexlist.com/]
Spyware:Cookie/SpyLog Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.spylog.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.dist.belnk.com/]
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.belnk.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\James Stack\Application Data\Mozilla\Firefox\Profiles\349t1qw3.default\cookies.txt[.adtech.de/]
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\James Stack\Cookies\james stack@cs.sexcounter[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\James Stack\Desktop\New Folder (2)\process203.zip[Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\James Stack\Desktop\New Folder (2)\SmitfraudFix\SmitfraudFix\Process.exe
Virus:Trj/Shutdown.Z Disinfected C:\Documents and Settings\James Stack\Desktop\New Folder (2)\SmitfraudFix\SmitfraudFix\restart.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\James Stack\Desktop\New Folder (2)\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Virus:Trj/Shutdown.Z Disinfected C:\Documents and Settings\James Stack\Desktop\New Folder (2)\SmitfraudFix.zip[SmitfraudFix/restart.exe]
Spyware:Spyware/PeoplePC Not disinfected C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\RAS.DLL
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe

Thanks again for your time, and patinece it is appreciated

[pskelley]

Welcome to the forum, sorry to be the bearer of bad news, you have a nasty infection, have a look:
C:\WINDOWS\svzhost.exehttp://www.google.com/search?hl=en&q=svzhost.exe&btnG=Google+Search
http://www.sophos.com/security/analyses/w32forbotev.html <<< probably this one
Deletes files off the computer
Steals information
Downloads code from the internet
Reduces system security
Installs itself in the Registry

C:\WINDOWS\System32\IEXPL0RER.exe
http://www.sophos.com/virusinfo/analyses/w32agobotql.html
Allows others to access the computer
Modifies data on the computer
Downloads code from the internet
Reduces system security
Installs itself in the Registry

C:\WINDOWS\system32\win_update.exe
http://www.google.com/search?hl=en&q=win_update.exe&btnG=Search
Hard to tall. very bad no matter which one.

Your security is badly compromised and you need to have this information:
A Backdoor is a software program that gives an attacker unauthorized access to a machine and the means for remotely controlling the machine without the user's knowledge. A Backdoor compromises system integrity by making changes to the system that allow it to by used by the attacker for malicious purposes unknown to the user.

One or more of the identified infections is a backdoor trojan.
This allows hackers to remotely control your computer, steal critical system information and Download and Execute files
I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

Please let us know what you have decided to do in your next post.

Thanks

[Hates Viruses]

hey PSKELLY thanks

Looks Like I will have to do the dreaded reformatting.

I'm glad I have no personal info on this computer.

Thanks for the information...I wish there was another way:sad:

[pskelley]

I certainly can respect your decision, if it was one of my computers that is what I would do. Here is some information that may help:
http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html
http://spyware-free.us/tutorials/reformat/mainnopics.html

and some information they may help you avoid malware in the future:
Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[pskelley]

As the problem appears to be resolved this topic has been closed.

If you need it re-opened please send me or a forum staff member a private message (pm) and provide a link to the thread; this applies only to the original topic starter.

Anyone else with similar problems please start a new topic.

Thanks