"Critical System Error!"

[warehouse91]

Logfile of HijackThis v1.99.1
Scan saved at 2:58:06 PM, on 10/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5335.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\MMKeybd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Netropa\OSD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [polcoi] C:\WINDOWS\system32\polcoi.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BlazeServoTool] "C:\Program Files\BlazeVideo\BlazeDVD 5 Standard\MediaDetector.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\Downloaded Program Files\SbCIe02a.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://softdev.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/setup/RiffLick.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://financeworks.mathxl.com/applets/PearsonInstallAsst.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/2366950796a3a6828e03/netzip/RdxIE601.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k00719/sb02a.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140712185156
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1us.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F8B8AF16-CECF-4002-9CC0-1E18029D7770} (FWPlayer Control) - http://financeworks.mathxl.com/applets/FWPlayer.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - AppInit_DLLs: interceptor.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

 

[pskelley]

Today, 15:24 #12 <<< I posted at this time and all you did was post page after page of junk and that. Return to my post and follow the directions.

Thanks

 

[warehouse91]

SmitFraudFix v2.117

Scan done at 20:24:25.71, Tue 10/31/2006
Run from C:\Documents and Settings\Sean Freudenberg\Desktop\Forum Spy Destroyers\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End





---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:32:56 PM 10/31/2006

+ Scan result:



HKU\S-1-5-21-3615762775-1256799619-874574627-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{93CECBB2-6B1B-448D-91B9-72604EF70105} -> Adware.180Solutions : Cleaned with backup (quarantined).
HKU\S-1-5-21-3615762775-1256799619-874574627-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{93CECBB2-6B1B-448D-91B9-72604EF70105} -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer -> Adware.Delfin : Cleaned with backup (quarantined).
HKU\S-1-5-21-3615762775-1256799619-874574627-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1A29A79A-B9C8-44A9-BEDF-7FADDE3CF33F} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-3615762775-1256799619-874574627-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A29A79A-B9C8-44A9-BEDF-7FADDE3CF33F} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\IESkins -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\eskin -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0 -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOI -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOI\dynamic -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOI\static -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\dynamic -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1 -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\blank.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\block_sm.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\block_smli.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\blocked.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_add-but.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_back-but.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_enabled_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_left_pressed_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_middle_enabled_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_middle_pressed_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_cut_enabled_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_enabled_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\btn_right_pressed_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\business_promo.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\buttondir.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\components.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_cattree.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_flashpreview.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_frbottom.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_objects.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_pagingmodule.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_recentlyused.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_shadows.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\css_topbuttons.css -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\delete.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_clear_sound.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_freditpreferences.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_frtop.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_fs.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_select.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_sn_frbottom.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_sn_frobjects.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_sn_frtree.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\edit_sn_fs.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-backgrounds.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-bcards.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-ecards.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-emoticons.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-funny.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-help.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-images.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-info.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-more.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-new.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-new2.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-options.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-tell.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-temp.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-text.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def-email-voice.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-def.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-premium-email-premium.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-premium.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\email-t1-bg.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\flashpreview.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\frbottom3.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\frobjects3.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\frtop4.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\frtree3.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\fs3.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\hotbar_promo.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_checked_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_checked_pressed.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_clear_sound.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_close_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_close_pressed_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_edit_preview.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_edit_send.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_flash_preview.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_recently_used.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_remove_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_remove_pressed_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_sand-clock2.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tell_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tell_pressed_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_tree_null.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_unchecked_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\icon_unchecked_pressed_1.gif -> Adware.HotBar : Cleaned with backup (quarantined).

 

[warehouse91]

C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout2.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\img_barlayout4.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\img_corner_left.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\img_local_logo.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_basetemplate.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_hbgroups.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_hbobject3.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_hbobjectset3.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_iteratorsandreaders3.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_pagingmoduleobj3.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_texts3.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\js_xmltree3.js -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\layout.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\linkpathlegal.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\n.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\nav_b_2.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\nav_bb_2.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\nav_f_2.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\nav_ff_2.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\sn_flashplayer_top.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\submit.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bg.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bga.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_bgia.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_l.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_la.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_lia.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_r.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_ra.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tab_ria.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tree_dots.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tree_minus.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\tree_plus.gif -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_animations.xml -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_backgrounds.xml -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_ecards.xml -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_edit.xml -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_emoticons.xml -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\1\treedata_text.xml -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\business_promo.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\buttondir.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\code.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\email-def.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\email-premium.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\email-t1-bg.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\hotbar_promo.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\images.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\layout.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\linkpathlegal.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\HostOL\static\DownLoad\treexml.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1009740.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\101582.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1055549.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1056032.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1056441.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1056531.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1056563.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1056936.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1057181.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1057312.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1057412.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1057702.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1057703.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1057858.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1067164.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1068758.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1096066.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1130447.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1190249.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1383609.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1383623.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1383648.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1383674.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1384083.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1384138.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1384188.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1384201.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1384715.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1385383.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1385440.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1385558.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1385637.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1385818.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1385970.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1386066.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1386751.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\1387587.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\144914.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\144984.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\146438.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\16198.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\16496.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\167399.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\187725.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\190262.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\24419.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\254996.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\26528.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\267292.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\284939.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\373507.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\408082.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\410591.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\41312.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\483014.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\494726.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\498121.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\499863.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\525033.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\535981.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\543827.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\554943.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\566217.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\573421.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\57450.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\599685.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\6149.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\616585.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\639877.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\639904.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\651497.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\6602.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\667482.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\686001.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\690129.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\772653.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\805478.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\819382.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\828282.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\857974.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\881468.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\927899.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\978098.sdf -> Adware.HotBar : Cleaned with backup (quarantined).

 

[warehouse91]

C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\981276.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\ASPL.dat -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\bstat -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\domains.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\dynamic\ustat -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1 -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_categorize.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_favorites.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_hotbarcom.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_hsskin.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_premium.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_searchgo.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_weather.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Default_yellowpages.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\Top7_theweb.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\bubbles.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\bubbles2.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\bubbles2_Bubbles2.bbl -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\bubbles_Bubbles.bbl -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\business_promo.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\buttondir.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\components.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_1000.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_2000.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_3000.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bar.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar1.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar10.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar11.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar12.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar13.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar14.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar2.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar3.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar4.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar5.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar6.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar7.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar8.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_bbar9.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_logos.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_other.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\d_icons_buttons_x.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\default.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\email-t1-bg.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\hotbar-premium-hotbar-premium.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\hotbar-premium.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\hotbar_promo.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\hotbarcom.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\icons2.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\keywords_idx.idx -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\keywords_sdf.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\layout.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\linkpathlegal.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\s_icons_buttons.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\samplegroups2.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\t2_bg.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\theweb.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\top7.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\1\tsd_bg.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2 -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_categorize.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_favorites.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_hotbarcom.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_hsskin.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_premium.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_searchgo.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_weather.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Default_yellowpages.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\Top7_theweb.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\bubbles.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\bubbles2.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\bubbles2_Bubbles2.bbl -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\bubbles_Bubbles.bbl -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\business_promo.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\buttondir.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\components.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_1000.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_2000.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_3000.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bar.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar1.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar10.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar11.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar12.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar13.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar14.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar2.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar3.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar4.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar5.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar6.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar7.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar8.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_bbar9.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_logos.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_other.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\d_icons_buttons_x.res -> Adware.HotBar : Cleaned with backup (quarantined).

 

[warehouse91]

C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\default.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\email-t1-bg.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\hotbar-premium-hotbar-premium.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\hotbar-premium.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\hotbar_promo.htm -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\hotbarcom.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\icons2.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\keywords_idx.idx -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\keywords_sdf.sdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\layout.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\linkpathlegal.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\s_icons_buttons.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\samplegroups2.txt -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\t2_bg.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\theweb.mnu -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\top7.cdf -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\2\tsd_bg.res -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\bubbles.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\bubbles2.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\business_promo.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\buttondir.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_1000.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_2000.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_3000.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bar.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar1.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar10.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar11.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar12.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar13.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar14.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar2.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar3.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar4.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar5.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar6.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar7.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar8.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_bbar9.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_logos.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_other.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\d_icons_buttons_x.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\default.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\email-t1-bg.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\hotbar-premium.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\hotbar_promo.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\icons2.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\keywords_idx.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\keywords_sdf.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\layout.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\linkpathlegal.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\s_icons_buttons.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\samplegroups2.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\t2_bg.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\top7.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Application Data\Hotbar\v3.0\Hotbar\static\DownLoad\tsd_bg.xip -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1201\A0177344.DLL -> Adware.ProtectionBar : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\SbCIe02a.dll -> Adware.SideStep : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1199\A0177111.EXE -> Adware.VirusBurster : Cleaned with backup (quarantined).
C:\Program Files\Search Toolbar\toolbar.dll -> Adware.WebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\AUI -> Adware.WebSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Sean Freudenberg\Local Settings\Temp\temp.fr2D17\MediaGateway.exe -> Adware.WinAD : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Local Settings\Temp\~16987.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Local Settings\Temp\~768552.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Local Settings\Temp\~803483.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Local Settings\Temp\~917096.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Local Settings\Temp\~929786.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1202\A0177549.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1202\A0177550.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1202\A0177544.dll -> Downloader.Zlob.ase : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1202\A0177545.exe -> Downloader.Zlob.ase : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1202\A0177546.exe -> Downloader.Zlob.ase : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1191\A0175848.EXE -> Not-A-Virus.Downloader.Win32.WinFixer.d : Cleaned with backup (quarantined).
C:\Documents and Settings\Guest\Local Settings\Temporary Internet Files\Content.IE5\G7CUXEIB\eifr[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Cleaned with backup (quarantined).

 

[warehouse91]

Logfile of HijackThis v1.99.1
Scan saved at 10:49:22 PM, on 10/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5335.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\MMKeybd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Napster\napster.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
F2 - REG:system.ini: Shell=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [polcoi] C:\WINDOWS\system32\polcoi.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BlazeServoTool] "C:\Program Files\BlazeVideo\BlazeDVD 5 Standard\MediaDetector.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\Downloaded Program Files\SbCIe02a.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://softdev.adelphia.net/sdccommon/download/tgctlins.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/setup/RiffLick.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://financeworks.mathxl.com/applets/PearsonInstallAsst.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/2366950796a3a6828e03/netzip/RdxIE601.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k00719/sb02a.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140712185156
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1us.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F8B8AF16-CECF-4002-9CC0-1E18029D7770} (FWPlayer Control) - http://financeworks.mathxl.com/applets/FWPlayer.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - AppInit_DLLs: interceptor.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

 

[pskelley]

It would be helpful if you would communicate so I will know how we are doing.

1) Update your Java program, see this information: http://forums.spybot.info/showpost.php?p=12880&postcount=2
C:\Program Files\Java\jre1.5.0_06\ <<< out of date

2) This item, I suggest you uninstall it, here is some information: http://news.findlaw.com/legalnews/lit/napster/
This is your call.

3) Turn off the Guard.exe function in AVG Anti-Spyware, it may block the changes we need to make.
Should be like this: Deactivate the Resident Shield
- Before proceeding, deactivate the "Resident Shield" as this may prevent changes to the registry.
- To do this, click "Change State" to the right of the Resident Shield option in the main window.
- You will clearly see the status change to Inactive if you have done this correctly.

4) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

5) Please download ATF Cleaner by Atribune
http://www.atribune.org/content/view/25/2/
Save it to your Desktop. We will use this later.

6) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

F2 - REG:system.ini: Shell=
O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
See this >> http://www.spywarewarrior.com/rogue_anti-spyware.htm
O4 - HKCU\..\Run: [polcoi] C:\WINDOWS\system32\polcoi.exe
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\Downloaded Program Files\SbCIe02a.dll (file missing)
(you can remove this advanced option if you wish)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://softdev.adelphia.net/sdccommo...d/tgctlins.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/23669507...p/RdxIE601.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k00719/sb02a.cab

Close all programs but HJT and all browser windows, then click on "Fix Checked"

7) RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\Program Files\SpywareBot\ <<< delete that folder

C:\WINDOWS\system32\polcoi.exe <<< delete that file

8) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

Restart the computer and post a new HJT log. Let me know how the computer is running now.

Thanks

 

[warehouse91]

look, i appreciate your help and everything. i thought i was communicating by me posting the logs. i dont know what all that stuff means in there, i just thought you could tell what was wrong by looking at those. im sorry if it seems im not comunicating, but i think its more along the lines of me not knowing what you need.

i'm going to class now, ill be back at 1pm est.

Thanks

 

[warehouse91]

1) Update your Java program, see this information: http://forums.spybot.info/showpost.php?p=12880&postcount=2
C:\Program Files\Java\jre1.5.0_06\ <<< out of date

when i click on add/remove programs, the list says it is populating but it never comes up.

 

[pskelley]

Make sure you allow enough time, some time it takes several minutes. If it continues to not populate, then continue with the balance of the instructions and let me know. I will see what I can find out about the problem with Add Remove programs. Once the rest of the instructions are finished, then look at this link to update and verify your Java installation at least:
http://www.java.com/en/download/windows_xpi.jsp

Thanks

 

[warehouse91]

ok a couple of things:

Step 1: Complete

Step 2: when i click "remove" an error mgs comes up
"C:\program~1\common~1\instal~1\profes~1runtime\11\50\intel32\ctor.dll
the specified module could not be found

Step 3: Complete

Step 4: Complete

Step 5: Complete

Step 6: Complete

Step 7: cant locate C:\programfiles\spywarebot ("spybot" folder exists but not "spywarebot")
can't locate C:\windows\system32\polcoi.exe (its just not there)

Step 8: i didnt do this step yet

i thought i would let you know that my computer is running very well now.

thanks

 

[pskelley]

Step 2: when i click "remove" an error mgs comes up
"C:\program~1\common~1\instal~1\profes~1runtime\11\50\intel32\ctor.dll
the specified module could not be found

I'll know more when I see the next HJT log.

Step 7: cant locate C:\programfiles\spywarebot ("spybot" folder exists but not "spywarebot")
can't locate C:\windows\system32\polcoi.exe (its just not there)

Same with these two...need to see the HJT log

i thought i would let you know that my computer is running very well now.

You have removed a lot of nasty junk from your computer, let me see the new HJT log and I will know if we have more to do. Let me know about any problems also.

Thanks

 

[warehouse91]

Ok went into hijackthis and clicked "none, just start the program" then clicked on scan, here is the log:


Logfile of HijackThis v1.99.1
Scan saved at 2:43:31 PM, on 11/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5335.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\MMKeybd.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Napster\napster.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [polcoi] C:\WINDOWS\system32\polcoi.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BlazeServoTool] "C:\Program Files\BlazeVideo\BlazeDVD 5 Standard\MediaDetector.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/setup/RiffLick.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://financeworks.mathxl.com/applets/PearsonInstallAsst.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140712185156
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1us.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F8B8AF16-CECF-4002-9CC0-1E18029D7770} (FWPlayer Control) - http://financeworks.mathxl.com/applets/FWPlayer.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - AppInit_DLLs: interceptor.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

 

[pskelley]

OK, we are getting close, but we still have a few issues. This one you can keep if you are sure it is safe:
C:\Program Files\Napster\napster.exe
I am going to show you how to remove it and you can pass those instruction if you wish. This one: O4 - HKCU\..\Run: [polcoi] C:\WINDOWS\system32\polcoi.exe there is little doubt in my mind this is a trojan, you can use these free scans to check it if you wish:
http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustotal.com/flash/index_en.html

Before you start, you have programs that will block the fix, we must turn them off.

1) Windows Defender: We need to disable your Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.
Open Windows Defender, Click on Tools, General Settings.
Scroll down and uncheck Turn on real-time protection (recommended).
After you uncheck this, click on the Save button and close Windows Defender.
After all of the fixes are complete it is very important that you enable Real-time Protection again.

2) C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe <<< the guard feature may block our changes and it may also conflict with Windows Defender, so turn it off and leave it off.
Deactivate the Resident Shield
- Before proceeding, deactivate the "Resident Shield" as this may prevent changes to the registry.
- To do this, click "Change State" to the right of the Resident Shield option in the main window.
- You will clearly see the status change to Inactive if you have done this correctly. It goes away after the trial period anyway.

3) SpyCatcher 2006 <<< I am not sure about this one, I would open the program and turn it off while you make these HJT changes. It may be that it will also conflict with Windows Defender, you may want to email their tech support and ask.

4) Make sure all files and folders are still enabled so you can see this stuff if it is there.

5) Start > Control Panel > Add Remove programs and uninstall Napster. Uninstall any other programs you know should not be there, if you are not sure, let me know and I will look.

6) If the instructions I posted above are not followed, this fix will not work!!

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKCU\..\Run: [polcoi] C:\WINDOWS\system32\polcoi.exe

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Enable hidden files&folders..reverse the process when finished.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\Program Files\Napster\ <<< delete the folder

C:\WINDOWS\system32\polcoi.exe <<< delete this file

Restart the computer and post a new HJT log, let me know how the computer is running and about any problems.

Thanks

 

[warehouse91]

Logfile of HijackThis v1.99.1
Scan saved at 5:03:33 PM, on 11/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5335.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\MMKeybd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Netropa\OSD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MUSICM~1\Common\COMPON~1\MMCOMP~1.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BlazeServoTool] "C:\Program Files\BlazeVideo\BlazeDVD 5 Standard\MediaDetector.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher 2006\Scheduler daemon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt0_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/setup/RiffLick.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://financeworks.mathxl.com/applets/PearsonInstallAsst.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140712185156
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1us.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F8B8AF16-CECF-4002-9CC0-1E18029D7770} (FWPlayer Control) - http://financeworks.mathxl.com/applets/FWPlayer.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - AppInit_DLLs: interceptor.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

it looks like napster is gone, and the computer is running very well so far. it restarted quickly and only took a little bit of time to let me start clicking around on windows. no napster icon in the taskbar.

 

[warehouse91]

Also, when I shut down the computer an end program pane comes up and says ending program shellcon...or somthing like that. I'm just not sure what that is. It is only visiable for a second or two, and then the computer shuts down.

Thanks

 

[pskelley]

Sounds good, if you can get the exact words of the message that is showing up I may be able to help. The HJT log looks good, I suggest you use HJT to remove these items:

O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/game...ts/y/jt0_x.cab G
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/game...ts/y/tt0_x.cab G
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt0_x.cab

Here is some information about: Shellcon
http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=GGLG,GGLG:2006-16,GGLG:en&q=shellcon
It may have to do with this recently downloaded MusicMatch item:
C:\PROGRA~1\MUSICM~1\Common\COMPON~1\MMCOMP~1.EXE

System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?Open&src=sec_doc_nam

AVG Anti-Spyware is a good program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

tashi will close your topic in a few days.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

 

[LonnyRJones]

Im Glad we could help
Since the problems are solved Im going to close the topic now, this keeps others with similar problems from posting there logs/question here, they should start a new topic.

If you should need to post another log for the same PC let one of us know via a PM (personal message).