Hijack Log 1.99

TheTrueDarkOne · January 17, 2006

Logfile of HijackThis v1.99.1

Scan saved at 7:14:38 PM, on 1/16/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE

C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe

C:\Program Files\AIM\aim.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\Program Files\hijackthis\hijackthis\HijackThis.exe

C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [VZRemoteCommander] C:\Program Files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe

O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [trioService] "C:\PROGRA~1\Freeze.com\3D Falling Leaves\\trioService.exe "

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe

O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [084c0f6g.dll] RUNDLL32.EXE 084c0f6g.dll,b 25956375

O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: FreezeScreenSaver - Unknown owner - C:\WINDOWS\system32\FreezeScreenSaver.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

therock247uk · January 17, 2006

Please download ewido anti-malware it is a trial version of the program.

Install ewido anti-malware
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Launch ewido, there should be an icon on your desktop double-click it.
The program will now go to the main screen

You will need to update ewido to the latest definition files.

On the left hand side of the main screen click update
Then click on Start Update

The update will start and a progress bar will show the updates being installed.

If you are having problems with the updater, you can use this link to manually update ewido.

ewido manual updates

Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.

Open Ewido again

Click on scanner
Click on Complete System Scan and the scan will begin.
While the scan is in progress you will be prompted to clean files, click OK
When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report.
Save the report .txt file to your desktop.

Now close ewido anti-malware.

Reboot and Post the report Ewido made and a new Hijackthis log here in a reply.

TheTrueDarkOne · January 17, 2006

The Log was clean though right?

going over to his house right now to finish doing this

therock247uk · January 18, 2006

The hijackthis log is not clean.

TheTrueDarkOne · January 18, 2006

EWIDO

----------------------------------------

ewido anti-malware - Scan report

---------------------------------------------------------

+ Created on: 3:55:33 PM, 1/17/2006

+ Report-Checksum: D453588F

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{3643ABC2-21BF-46B9-B230-F247DB0C6FD6} -> Spyware.E2Give : Cleaned with backup

HKLM\SOFTWARE\Classes\IeBHOs.Control -> Spyware.E2G : Error during cleaning

HKLM\SOFTWARE\Classes\IeBHOs.Control.1 -> Spyware.E2G : Error during cleaning

HKLM\SOFTWARE\Classes\Interface\{C89435B0-CDFE-11D3-976A-00E02913A9E0} -> Spyware.WebHancer : Cleaned with backup

HKLM\SOFTWARE\Classes\TypeLib\{C8CB3870-CDFE-11D3-976A-00E02913A9E0} -> Spyware.WebHancer : Cleaned with backup

HKLM\SOFTWARE\Classes\WhIeHelperObj.WhIeHelperObj -> Spyware.Webhancer : Error during cleaning

HKLM\SOFTWARE\Classes\WhIeHelperObj.WhIeHelperObj.1 -> Spyware.Webhancer : Error during cleaning

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3643ABC2-21BF-46B9-B230-F247DB0C6FD6} -> Spyware.E2Give : Cleaned with backup

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent -> Spyware.WebHancer : Cleaned with backup

HKLM\SOFTWARE\webhancer -> Spyware.Webhancer : Cleaned with backup

HKLM\SOFTWARE\webhancer\CC -> Spyware.Webhancer : Cleaned with backup

HKLM\SOFTWARE\webhancer\ESO -> Spyware.Webhancer : Cleaned with backup

HKU\S-1-5-21-3484876921-212355373-333284617-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3643ABC2-21BF-46B9-B230-F247DB0C6FD6} -> Spyware.E2Give : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Addynamix : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@burstnet[1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@burstnet[3].txt -> Spyware.Cookie.Burstnet : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@burstnet[4].txt -> Spyware.Cookie.Burstnet : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@burstnet[5].txt -> Spyware.Cookie.Burstnet : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Clickzs : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Overture : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Overture : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][2].txt -> Spyware.Cookie.Tfag : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Adbrite : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Adtrak : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][2].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\scott@yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\Documents and Settings\Scott\Cookies\[email protected][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup

C:\Program Files\E2G\IeBHOs.dll -> Adware.E2Give : Cleaned with backup

C:\Program Files\webHancer\Programs\whagent.exe -> Spyware.WebHancer : Cleaned with backup

C:\Program Files\webHancer\Programs\whiehlpr.dll -> Adware.WebHancer : Cleaned with backup

C:\Program Files\webHancer\Programs\whinstaller.exe -> Adware.WebHancer : Cleaned with backup

C:\Program Files\webHancer\Programs\whsurvey.exe -> Adware.WebHancer : Cleaned with backup

C:\Program Files\whInstall -> Adware.Webhancer : Cleaned with backup

C:\Program Files\whInstall\license.txt -> Adware.Webhancer : Cleaned with backup

C:\Program Files\whInstall\readme.txt -> Adware.Webhancer : Cleaned with backup

C:\Program Files\whInstall\whAgent.ini -> Adware.Webhancer : Cleaned with backup

C:\RECYCLER\NPROTECT\00000005.TXT -> Spyware.Cookie.2o7 : Cleaned with backup

C:\RECYCLER\NPROTECT\00000006.TXT -> Spyware.Cookie.2o7 : Cleaned with backup

C:\RECYCLER\NPROTECT\00000028.TXT -> Spyware.Cookie.2o7 : Cleaned with backup

C:\RECYCLER\NPROTECT\00000878.TXT -> Spyware.Cookie.2o7 : Cleaned with backup

C:\RECYCLER\NPROTECT\00000892.exe -> Logger.Agent.gk : Cleaned with backup

C:\RECYCLER\NPROTECT\00000893.dll -> Logger.Agent.gk : Cleaned with backup

C:\RECYCLER\NPROTECT\00000894.exe -> Logger.VB.eh : Cleaned with backup

C:\RECYCLER\NPROTECT\00000933.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000934.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000935.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000936.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000937.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000938.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000939.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000940.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000941.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000942.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000943.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000944.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000945.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000949.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000950.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000951.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000954.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\RECYCLER\NPROTECT\00000972.TXT -> Spyware.Cookie.Overture : Cleaned with backup

C:\RECYCLER\NPROTECT\00001021.TXT -> Spyware.Cookie.2o7 : Cleaned with backup

C:\RECYCLER\NPROTECT\00001052.TXT -> Spyware.Cookie.Overture : Cleaned with backup

C:\RECYCLER\NPROTECT\00001063.TXT -> Spyware.Cookie.2o7 : Cleaned with backup

C:\RECYCLER\S-1-5-21-3484876921-212355373-333284617-1007\Dc3.exe -> Downloader.Small.bgl : Cleaned with backup

C:\WINDOWS\NDNuninstall6_98.exe -> Adware.NewDotNet : Cleaned with backup

C:\WINDOWS\system32\cps_32.dll -> Logger.Agent.gk : Cleaned with backup

C:\WINDOWS\system32\cps_32.exe -> Logger.Agent.gk : Cleaned with backup

C:\WINDOWS\system32\doccps.exe -> Logger.VB.eh : Cleaned with backup

C:\WINDOWS\system32\drsmartload348a.exe -> Downloader.Adload.j : Cleaned with backup

C:\WINDOWS\system32\lockbr.exe -> Backdoor.IRCBot.ll : Cleaned with backup

C:\WINDOWS\system32\pi1_58.exe -> Downloader.Small.bue : Cleaned with backup

C:\WINDOWS\system32\whCC-CLICK.exe/whAgent.exe -> Spyware.WebHancer : Cleaned with backup

::Report End

--------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1

Scan saved at 9:40:47 PM, on 1/17/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE

C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Sony\VAIO Zone Remote Commander\AvRmtCtr.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\AIM\aim.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe