Ouch! You have numerous infections, so this is going to take a bit. Please be patient, follow any and all instructions we offer exactly, and don't hesitate to ask questions if there's something you're unsure of.

HijackThis alone isn't going to fix everthying you have, so let's see how much of it we can clean up before we delve into your log.

A) Do all 3 of the following free online virus/spyware scans. Please post the results reported by each:

http://www.kaspersky.com/scanforvirus.html
http://housecall.trendmicro.com/
http://www.pandasoftware.com/actives..._principal.htm


B) Run a full anti-virus scan with Norton if you haven't already, making sure that you have downloaded the most current virus definition updates. If Norton finds files that it says it can't clean or delete, post the locations of those files.


C) Download and run Ad Aware and SpyBot Search & Destroy (download links are in my sig below).

Follow these directions for configuring Ad Aware (directions courtesy of our member "crunchie"):

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan

2.Close ALL windows except Ad-Aware SE

3. Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window

1) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

Under Definitions:
*Prompt to udate outdated definitions - set the number of days


2) Click on the ‘Scanning’ button on the left and select in green :

Under Driver, Folders & Files:
*Scan Within Archives

Under Select drives & folders to scan -
*choose all hard drives

Under Memory & Registry: all green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file


3) Click on the ‘Advanced’ button on the left and select in green:

Under Shell Integration:
*Move deleted files to recycle bin

Under Logfile Detail Level: (all green)
*include addtional object information
*DESELECT - include negligible objects information
*include environment information

Under Alternate Data Streams:
*Don't log streams smaller than 0 bytes
*Don't log ADS with the following names: CA_INOCULATEIT


4) Click the ‘Tweak’ button and select in green:

Under the ‘Scanning Engine’:
*Unload recognized processes during scanning
*Scan registry for all users instead of current user only


Under the ‘Cleaning Engine’:
*Let Windows remove files in use at next reboot


Under the Log Files:
*Include basic Ad-aware SE settings in logfile
*Include additional Ad-aware SE settings in logfile
*Please do not check or make green: Include Module list in logfile


5. Click on ‘Proceed’ to save the settings.

6. Click ‘Start’

*Choose:'Perform Full System Scan'
*DESELECT "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.

7. Click ‘Next’ and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.

8. If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window

9. Save the log file when it asks and then click ‘finish’

10. REBOOT to complete the removal of what Ad-Aware SE found


* Run SpyBot.

When you first run SpyBot, it will walk you through a Wizard which will perform a few critical functions (making a registry backup, getting the latest updates, etc.).

1. Perform all of the Wizard's tasks.
2. Run the program. Once it completes, have it fix everything it finds.
3. Reboot.


D) Boot into Safe Mode (do this by hitting the F8 key as the computer is booting) and:

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- Delete the following 2 folders entirely:

C:\Program Files\ISTsvc
C:\Program Files\WareOut

- For every user account listed under C:\Documents and Settings, delete everything inside the following folders (don't delete the folders themselves though):

1. Local Settings\Temp
2. Cookies
3. History
4. Local Settings\Temporary Internet Files\Content.IE5

- Delete the entire content of your C:\Windows\Temp folder.

(If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed.)

- Empty your Recycle Bin.


E) Reboot normally, run HijackThis again, and post a new log.

I need help too please.
I have window 98 SE running on Pentium 2 350MHZ
Norton antivirus 2004 - updated
Adaware se proofessional v.1.03 (cant update to 1.05 as I lost reg #)
spybot - latest
About blank removal (recently bought but useless)
Spyware nuker 2005 (recently bought but another failure!!!)
I have tried adaware, it's detected but still have probs as I was half asleep and click OK to let about blank got through. I currently switch adwatch off as it keeps popping up to ask change home page to about blank
Norton scan and clean virus but it's still there
Got AB remover last night and hav this when finished scanning: Done! Removed from your system:- CWS.HiddenDll but still there the next time scanned
Got spyware nuker this morning and scan 5 times still keep asking to restart PC each time : Keep saying threre's 1 item cannot be removed without restarting but still same message each time. Heres the log:
********* Spyware Nuker Log File **********
- Version: 3.3.16.1 Build 1
- Definition Database Date: 3/7/2005 08:39:40 AM (8857 entries)
- OS version: Windows 98 4.10.2222 [ A ]
- Web Browser Version: IE:6.0.2800.1106;
- User ID:
= 03/12/2005 08:38:00 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 08:38:43 process list begins (scan)
= 03/12/2005 08:38:43 -000003148577 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 08:38:43 -000000024517 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 08:38:43 -000000018517 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 08:38:43 -000000110621 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 08:38:43 -000000119289 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 08:38:43 -000000076561 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 08:38:43 -000000070241 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 08:38:43 -000000106069 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 08:38:43 -000000156673 C:\WINDOWS\EXPLORER.EXE
= 03/12/2005 08:38:43 -000000253825 C:\WINDOWS\TASKMON.EXE
= 03/12/2005 08:38:43 -000000248625 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
= 03/12/2005 08:38:43 -000000251049 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
= 03/12/2005 08:38:43 -000000246525 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
= 03/12/2005 08:38:43 -000000318273 C:\WINDOWS\SYSTEM\BCMWLTRY.EXE
= 03/12/2005 08:38:43 -000000281601 C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
= 03/12/2005 08:38:43 -000000245153 C:\WINDOWS\SYSTEM\WMIEXE.EXE
= 03/12/2005 08:38:43 -000000579561 C:\WINDOWS\SYSTEM\DDHELP.EXE
= 03/12/2005 08:38:43 -000000446317 C:\DOWNLOAD\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-WATCH.EXE
= 03/12/2005 08:38:43 -000000190761 C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
= 03/12/2005 08:38:43 -000000519497 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 08:38:43 process list ends (scan)
= 03/12/2005 08:39:10 Scan result:

966-55884: Cookie: nga@dist.belnk[2].txt: dMS

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 08:49:43 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 08:50:07 process list begins (scan)
= 03/12/2005 08:50:07 -000003148577 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 08:50:07 -000000024517 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 08:50:07 -000000018517 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 08:50:07 -000000110621 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 08:50:07 -000000119289 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 08:50:07 -000000076561 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 08:50:07 -000000070241 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 08:50:07 -000000106069 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 08:50:07 -000000156673 C:\WINDOWS\EXPLORER.EXE
= 03/12/2005 08:50:07 -000000253825 C:\WINDOWS\TASKMON.EXE
= 03/12/2005 08:50:07 -000000248625 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
= 03/12/2005 08:50:07 -000000251049 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
= 03/12/2005 08:50:07 -000000246525 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
= 03/12/2005 08:50:07 -000000318273 C:\WINDOWS\SYSTEM\BCMWLTRY.EXE
= 03/12/2005 08:50:07 -000000281601 C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
= 03/12/2005 08:50:07 -000000245153 C:\WINDOWS\SYSTEM\WMIEXE.EXE
= 03/12/2005 08:50:07 -000000579561 C:\WINDOWS\SYSTEM\DDHELP.EXE
= 03/12/2005 08:50:07 -000000519497 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 08:50:07 -000000556777 C:\WINDOWS\SYSTEM\PSTORES.EXE
= 03/12/2005 08:50:07 -000000472381 C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
= 03/12/2005 08:50:07 -000000683865 C:\WINDOWS\SYSTEM\SPOOL32.EXE
= 03/12/2005 08:50:07 process list ends (scan)
= 03/12/2005 08:50:20 Scan result:

966-55884: Cookie: nga@dist.belnk[2].txt: dMS

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 08:50:26 Start removing/backuping
= 03/12/2005 08:50:26 *** begin process cleanup ***
= 03/12/2005 08:50:26 *** end process cleanup ***
= 03/12/2005 08:50:26 *** begin registry cleanup ***
= 03/12/2005 08:50:26 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 08:50:26 Repair of LSP chain started (process -519497, thread -660885)
= 03/12/2005 08:50:26 re-generation of LSP chain complete
= 03/12/2005 08:50:26 re-generation of LSP chain complete
= 03/12/2005 08:50:26 Repair of LSP chain finished (process -519497, thread -660885)
= 03/12/2005 08:50:26 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 08:50:26 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 08:50:26 *** end registry cleanup ***
= 03/12/2005 08:50:26 *** begin files cleanup ***
= 03/12/2005 08:50:26 *** end files cleanup ***
= 03/12/2005 08:50:27 Removing finished! Total removed:6
= 03/12/2005 08:50:27 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

********* Spyware Nuker Log File **********
- Version: 3.3.16.1 Build 1
- Definition Database Date: 3/7/2005 08:39:40 AM (8857 entries)
- OS version: Windows 98 4.10.2222 [ A ]
- Web Browser Version: IE:6.0.2800.1106;
- User ID:
= 03/12/2005 08:52:25 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 08:54:15 process list begins (scan)
= 03/12/2005 08:54:15 -000003148451 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 08:54:15 -000000024135 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 08:54:15 -000000018903 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 08:54:15 -000000111007 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 08:54:15 -000000118867 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 08:54:15 -000000076491 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 08:54:15 -000000070483 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 08:54:15 -000000069611 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 08:54:15 -000000086887 C:\WINDOWS\SYSTEM\RUNONCE.EXE
= 03/12/2005 08:54:15 -000000138243 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 08:54:15 -000000245611 C:\WINDOWS\RUNDLL32.EXE
= 03/12/2005 08:54:15 process list ends (scan)
= 03/12/2005 08:54:23 Scan result:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 08:54:30 Start removing/backuping
= 03/12/2005 08:54:31 *** begin process cleanup ***
= 03/12/2005 08:54:31 *** end process cleanup ***
= 03/12/2005 08:54:31 *** begin registry cleanup ***
= 03/12/2005 08:54:31 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 08:54:31 Repair of LSP chain started (process -138243, thread -285011)
= 03/12/2005 08:54:31 re-generation of LSP chain complete
= 03/12/2005 08:54:31 re-generation of LSP chain complete
= 03/12/2005 08:54:31 Repair of LSP chain finished (process -138243, thread -285011)
= 03/12/2005 08:54:31 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 08:54:31 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 08:54:31 *** end registry cleanup ***
= 03/12/2005 08:54:31 *** begin files cleanup ***
= 03/12/2005 08:54:31 *** end files cleanup ***
= 03/12/2005 08:54:31 Removing finished! Total removed:5
= 03/12/2005 08:54:32 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

********* Spyware Nuker Log File **********
- Version: 3.3.16.1 Build 1
- Definition Database Date: 3/7/2005 08:39:40 AM (8857 entries)
- OS version: Windows 98 4.10.2222 [ A ]
- Web Browser Version: IE:6.0.2800.1106;
- User ID:
= 03/12/2005 08:56:21 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 08:58:13 process list begins (scan)
= 03/12/2005 08:58:13 -000003148535 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 08:58:13 -000000024083 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 08:58:13 -000000018819 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 08:58:13 -000000111051 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 08:58:13 -000000118831 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 08:58:13 -000000076487 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 08:58:13 -000000070435 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 08:58:13 -000000069395 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 08:58:13 -000000188915 C:\WINDOWS\SYSTEM\RUNONCE.EXE
= 03/12/2005 08:58:13 -000000156975 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 08:58:13 -000000159199 C:\WINDOWS\RUNDLL32.EXE
= 03/12/2005 08:58:13 process list ends (scan)
= 03/12/2005 08:58:20 Scan result:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 08:59:22 Start removing/backuping
= 03/12/2005 08:59:23 *** begin process cleanup ***
= 03/12/2005 08:59:23 *** end process cleanup ***
= 03/12/2005 08:59:23 *** begin registry cleanup ***
= 03/12/2005 08:59:23 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 08:59:23 Repair of LSP chain started (process -156975, thread -291739)
= 03/12/2005 08:59:23 re-generation of LSP chain complete
= 03/12/2005 08:59:23 re-generation of LSP chain complete
= 03/12/2005 08:59:23 Repair of LSP chain finished (process -156975, thread -291739)
= 03/12/2005 08:59:23 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 08:59:23 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 08:59:23 *** end registry cleanup ***
= 03/12/2005 08:59:23 *** begin files cleanup ***
= 03/12/2005 08:59:23 *** end files cleanup ***
= 03/12/2005 08:59:24 Removing finished! Total removed:5
= 03/12/2005 08:59:24 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

********* Spyware Nuker Log File **********
- Version: 3.3.16.1 Build 1
- Definition Database Date: 3/7/2005 08:39:40 AM (8857 entries)
- OS version: Windows 98 4.10.2222 [ A ]
- Web Browser Version: IE:6.0.2800.1106;
- User ID:
= 03/12/2005 09:13:22 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 09:15:18 WARNING: binary scanner could not open file C:\WINDOWS\WIN386.SWP: OS Error 32: The process cannot access the file because
it is being used by another process
= 03/12/2005 09:25:20 WARNING: binary scanner could not open file C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll: OS Error 32: The process cannot access the file because
it is being used by another process
= 03/12/2005 09:39:39 process list begins (scan)
= 03/12/2005 09:39:39 -000003148535 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 09:39:39 -000000024083 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 09:39:39 -000000018819 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 09:39:39 -000000111051 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 09:39:39 -000000118831 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 09:39:39 -000000076487 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 09:39:39 -000000070435 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 09:39:39 -000000069395 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 09:39:39 -000000105711 C:\WINDOWS\EXPLORER.EXE
= 03/12/2005 09:39:39 -000000258215 C:\WINDOWS\TASKMON.EXE
= 03/12/2005 09:39:39 -000000198487 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
= 03/12/2005 09:39:39 -000000234871 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
= 03/12/2005 09:39:39 -000000209983 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
= 03/12/2005 09:39:39 -000000296271 C:\WINDOWS\SYSTEM\BCMWLTRY.EXE
= 03/12/2005 09:39:39 -000000323039 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 09:39:39 -000000270935 C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVW32.EXE
= 03/12/2005 09:39:39 -000000352275 C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
= 03/12/2005 09:39:39 -000000439999 C:\WINDOWS\SYSTEM\WMIEXE.EXE
= 03/12/2005 09:39:39 -000000275415 C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
= 03/12/2005 09:39:39 -000000599711 C:\WINDOWS\SYSTEM\DDHELP.EXE
= 03/12/2005 09:39:39 -000000590895 C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
= 03/12/2005 09:39:39 -000000694931 C:\WINDOWS\MSAGENT\AGENTSVR.EXE
= 03/12/2005 09:39:39 -000000714423 C:\WINDOWS\SYSTEM\SPOOL32.EXE
= 03/12/2005 09:39:39 -000000706575 C:\WINDOWS\SYSTEM\PSTORES.EXE
= 03/12/2005 09:39:39 process list ends (scan)
= 03/12/2005 09:46:56 Scan result:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 09:47:02 Start removing/backuping
= 03/12/2005 09:47:02 *** begin process cleanup ***
= 03/12/2005 09:47:02 *** end process cleanup ***
= 03/12/2005 09:47:02 *** begin registry cleanup ***
= 03/12/2005 09:47:02 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 09:47:02 Repair of LSP chain started (process -323039, thread -479395)
= 03/12/2005 09:47:02 re-generation of LSP chain complete
= 03/12/2005 09:47:02 re-generation of LSP chain complete
= 03/12/2005 09:47:02 Repair of LSP chain finished (process -323039, thread -479395)
= 03/12/2005 09:47:02 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 09:47:02 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 09:47:02 *** end registry cleanup ***
= 03/12/2005 09:47:02 *** begin files cleanup ***
= 03/12/2005 09:47:02 *** end files cleanup ***
= 03/12/2005 09:47:03 Removing finished! Total removed:5
= 03/12/2005 09:47:04 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

********* Spyware Nuker Log File **********
- Version: 3.3.16.1 Build 1
- Definition Database Date: 3/7/2005 08:39:40 AM (8857 entries)
- OS version: Windows 98 4.10.2222 [ A ]
- Web Browser Version: IE:6.0.2800.1106;
- User ID:
= 03/12/2005 09:50:37 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 09:53:09 WARNING: binary scanner could not open file C:\WINDOWS\WIN386.SWP: OS Error 32: The process cannot access the file because
it is being used by another process
= 03/12/2005 10:17:45 process list begins (scan)
= 03/12/2005 10:17:45 -000003148409 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 10:17:45 -000000024221 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 10:17:45 -000000018701 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 10:17:45 -000000110917 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 10:17:45 -000000118921 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 10:17:45 -000000076353 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 10:17:45 -000000070449 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 10:17:45 -000000091793 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 10:17:45 -000000087805 C:\WINDOWS\SYSTEM\RUNONCE.EXE
= 03/12/2005 10:17:45 -000000144817 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 10:17:45 -000000308529 C:\WINDOWS\RUNDLL32.EXE
= 03/12/2005 10:17:45 -000000358537 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
= 03/12/2005 10:17:45 process list ends (scan)
= 03/12/2005 10:18:14 Scan result:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 10:18:20 Start removing/backuping
= 03/12/2005 10:18:21 *** begin process cleanup ***
= 03/12/2005 10:18:21 *** end process cleanup ***
= 03/12/2005 10:18:21 *** begin registry cleanup ***
= 03/12/2005 10:18:21 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 10:18:21 Repair of LSP chain started (process -144817, thread -346513)
= 03/12/2005 10:18:21 re-generation of LSP chain complete
= 03/12/2005 10:18:21 re-generation of LSP chain complete
= 03/12/2005 10:18:21 Repair of LSP chain finished (process -144817, thread -346513)
= 03/12/2005 10:18:21 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 10:18:21 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 10:18:21 *** end registry cleanup ***
= 03/12/2005 10:18:21 *** begin files cleanup ***
= 03/12/2005 10:18:21 *** end files cleanup ***
= 03/12/2005 10:18:21 Removing finished! Total removed:5
= 03/12/2005 10:18:22 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

********* Spyware Nuker Log File **********
- Version: 3.3.16.1 Build 1
- Definition Database Date: 3/7/2005 08:39:40 AM (8857 entries)
- OS version: Windows 98 4.10.2222 [ A ]
- Web Browser Version: IE:6.0.2800.1106;
- User ID:
= 03/12/2005 10:56:16 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 10:56:43 process list begins (scan)
= 03/12/2005 10:56:43 -000003148409 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 10:56:43 -000000024221 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 10:56:43 -000000018701 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 10:56:43 -000000110917 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 10:56:43 -000000118921 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 10:56:43 -000000076353 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 10:56:43 -000000070449 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 10:56:43 -000000091793 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 10:56:43 -000000358537 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
= 03/12/2005 10:56:43 -000000163141 C:\WINDOWS\EXPLORER.EXE
= 03/12/2005 10:56:43 -000000271413 C:\WINDOWS\TASKMON.EXE
= 03/12/2005 10:56:43 -000000266301 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
= 03/12/2005 10:56:43 -000000390633 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
= 03/12/2005 10:56:43 -000000345361 C:\WINDOWS\SYSTEM\BCMWLTRY.EXE
= 03/12/2005 10:56:43 -000000199641 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 10:56:43 -000000219693 C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
= 03/12/2005 10:56:43 -000000216365 C:\WINDOWS\SYSTEM\WMIEXE.EXE
= 03/12/2005 10:56:43 -000000473913 C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
= 03/12/2005 10:56:43 -000000648717 C:\WINDOWS\SYSTEM\PSTORES.EXE
= 03/12/2005 10:56:43 -000000654701 C:\WINDOWS\SYSTEM\DDHELP.EXE
= 03/12/2005 10:56:43 process list ends (scan)
= 03/12/2005 10:56:56 Scan result:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

816-49877: Cookie: nga@tribalfusion[1].txt: ANON_ID

= 03/12/2005 10:57:05 Start removing/backuping
= 03/12/2005 10:57:05 *** begin process cleanup ***
= 03/12/2005 10:57:05 *** end process cleanup ***
= 03/12/2005 10:57:05 *** begin registry cleanup ***
= 03/12/2005 10:57:05 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 10:57:05 Repair of LSP chain started (process -199641, thread -246389)
= 03/12/2005 10:57:05 re-generation of LSP chain complete
= 03/12/2005 10:57:05 re-generation of LSP chain complete
= 03/12/2005 10:57:05 Repair of LSP chain finished (process -199641, thread -246389)
= 03/12/2005 10:57:05 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 10:57:05 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 10:57:05 *** end registry cleanup ***
= 03/12/2005 10:57:05 *** begin files cleanup ***
= 03/12/2005 10:57:05 *** end files cleanup ***
= 03/12/2005 10:57:06 Removing finished! Total removed:6
= 03/12/2005 10:57:06 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

= 03/12/2005 11:18:47 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 11:19:11 process list begins (scan)
= 03/12/2005 11:19:11 -000003148409 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 11:19:11 -000000024221 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 11:19:11 -000000018701 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 11:19:11 -000000110917 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 11:19:11 -000000118921 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 11:19:11 -000000076353 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 11:19:11 -000000070449 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 11:19:11 -000000091793 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 11:19:11 -000000358537 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
= 03/12/2005 11:19:11 -000000163141 C:\WINDOWS\EXPLORER.EXE
= 03/12/2005 11:19:11 -000000271413 C:\WINDOWS\TASKMON.EXE
= 03/12/2005 11:19:11 -000000266301 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
= 03/12/2005 11:19:11 -000000390633 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
= 03/12/2005 11:19:11 -000000345361 C:\WINDOWS\SYSTEM\BCMWLTRY.EXE
= 03/12/2005 11:19:11 -000000199641 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 11:19:11 -000000219693 C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
= 03/12/2005 11:19:11 -000000216365 C:\WINDOWS\SYSTEM\WMIEXE.EXE
= 03/12/2005 11:19:11 -000000473913 C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
= 03/12/2005 11:19:11 -000000648717 C:\WINDOWS\SYSTEM\PSTORES.EXE
= 03/12/2005 11:19:11 -000000654701 C:\WINDOWS\SYSTEM\DDHELP.EXE
= 03/12/2005 11:19:11 process list ends (scan)
= 03/12/2005 11:19:39 Scan result:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 11:19:44 Start removing/backuping
= 03/12/2005 11:19:44 *** begin process cleanup ***
= 03/12/2005 11:19:44 *** end process cleanup ***
= 03/12/2005 11:19:44 *** begin registry cleanup ***
= 03/12/2005 11:19:44 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 11:19:44 Repair of LSP chain started (process -199641, thread -295469)
= 03/12/2005 11:19:44 re-generation of LSP chain complete
= 03/12/2005 11:19:44 re-generation of LSP chain complete
= 03/12/2005 11:19:44 Repair of LSP chain finished (process -199641, thread -295469)
= 03/12/2005 11:19:44 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 11:19:44 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 11:19:44 *** end registry cleanup ***
= 03/12/2005 11:19:44 *** begin files cleanup ***
= 03/12/2005 11:19:44 *** end files cleanup ***
= 03/12/2005 11:19:44 Removing finished! Total removed:5
= 03/12/2005 11:19:44 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

********* Spyware Nuker Log File **********
- Version: 3.3.16.1 Build 1
- Definition Database Date: 3/7/2005 08:39:40 AM (8857 entries)
- OS version: Windows 98 4.10.2222 [ A ]
- Web Browser Version: IE:6.0.2800.1106;
- User ID:
= 03/12/2005 11:20:39 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 11:22:07 WARNING: binary scanner could not open file C:\WINDOWS\WIN386.SWP: OS Error 32: The process cannot access the file because
it is being used by another process
= 03/12/2005 11:22:49 User terminated the scaning.
= 03/12/2005 11:23:02 Start Scaning:
Registry,Files,Cookies,Processes,Hosts
= 03/12/2005 11:23:33 process list begins (scan)
= 03/12/2005 11:23:33 -000003148409 C:\WINDOWS\SYSTEM\KERNEL32.DLL
= 03/12/2005 11:23:33 -000000024221 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
= 03/12/2005 11:23:33 -000000018701 C:\WINDOWS\SYSTEM\MPREXE.EXE
= 03/12/2005 11:23:33 -000000110917 C:\WINDOWS\SYSTEM\mmtask.tsk
= 03/12/2005 11:23:33 -000000118921 C:\WINDOWS\SYSTEM\MSTASK.EXE
= 03/12/2005 11:23:33 -000000076353 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
= 03/12/2005 11:23:33 -000000070449 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
= 03/12/2005 11:23:33 -000000091793 C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
= 03/12/2005 11:23:33 -000000358537 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
= 03/12/2005 11:23:33 -000000163141 C:\WINDOWS\EXPLORER.EXE
= 03/12/2005 11:23:33 -000000271413 C:\WINDOWS\TASKMON.EXE
= 03/12/2005 11:23:33 -000000266301 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
= 03/12/2005 11:23:33 -000000390633 C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
= 03/12/2005 11:23:33 -000000345361 C:\WINDOWS\SYSTEM\BCMWLTRY.EXE
= 03/12/2005 11:23:33 -000000219693 C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
= 03/12/2005 11:23:33 -000000216365 C:\WINDOWS\SYSTEM\WMIEXE.EXE
= 03/12/2005 11:23:33 -000000473913 C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
= 03/12/2005 11:23:33 -000000648717 C:\WINDOWS\SYSTEM\PSTORES.EXE
= 03/12/2005 11:23:33 -000000654701 C:\WINDOWS\SYSTEM\DDHELP.EXE
= 03/12/2005 11:23:33 -000000372545 C:\PROGRAM FILES\SPYWARE NUKER 2004\SWN2.EXE
= 03/12/2005 11:23:33 process list ends (scan)
= 03/12/2005 11:23:47 Scan result:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46499: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
539-46496: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

886-52568: Registry Value: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
886-52566: Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
886-52563: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP

= 03/12/2005 11:23:53 Start removing/backuping
= 03/12/2005 11:23:53 *** begin process cleanup ***
= 03/12/2005 11:23:53 *** end process cleanup ***
= 03/12/2005 11:23:53 *** begin registry cleanup ***
= 03/12/2005 11:23:53 (TRegistryPatternList) Error: Delete Value HKLM\SOFTWARE\Microsoft\Internet Explorer\Mainearch BarREG_SZ:res://C:\WINDOWS\TEMP\se.dll/sp.html
= 03/12/2005 11:23:53 Repair of LSP chain started (process -372545, thread -299725)
= 03/12/2005 11:23:53 re-generation of LSP chain complete
= 03/12/2005 11:23:53 re-generation of LSP chain complete
= 03/12/2005 11:23:53 Repair of LSP chain finished (process -372545, thread -299725)
= 03/12/2005 11:23:53 Backing up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup...
= 03/12/2005 11:23:53 Backed up LSP Chain HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters to HKLM\Software\Spyware Nuker\LspBackup successfully
= 03/12/2005 11:23:53 *** end registry cleanup ***
= 03/12/2005 11:23:53 *** begin files cleanup ***
= 03/12/2005 11:23:53 *** end files cleanup ***
= 03/12/2005 11:23:53 Removing finished! Total removed:5
= 03/12/2005 11:23:53 Item(s) failed to be removed:

539-53426: Registry Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

And scan report:
Version: 3.3.16.1
Definition Database Date: 3/7/2005 08:39:40 AM
OS version: Windows 98 4.10.2222 [ A ]
Web Browser Version: IE:6.0.2800.1106;
Date/Time: 03/12/2005 08:58:26


CoolWebSearch - Hijacker 539 Hijacks browser settings and redirects traffic to a search portal site.
Registry Value 46496 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
Registry Value 46499 HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html
Registry Value 53426 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Mainearch Bar:res://C:\WINDOWS\TEMP\se.dll/sp.html

CWS.About_Blank - Hijacker 886 Hijacks browser homepage and search settings to a search portal. Can silently download and execute files.
Registry Value 52563 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main:HOMEOldSP
Registry Key 52566 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall
Registry Value 52568 HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main:HOMEOldSP
Please help.
Thanx

Hi Nashii,

First of all- welcome to TechTalk!

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there.

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforum..._faq#faq_rules


Thanks for understanding.



When you do start your new thread, please do the following:

Download the utility "HijackThis" from this location.

Once downloaded, create a new and separate folder outside of any Temp/Temporary folders for HJT and move it there. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...". Save the log in the folder you created for HiajckThis, open the log in Windows Notepad, and cut-n-paste the entire contents of the log into your new post. The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.