and,
Ad-Aware SE Personal log; full scan (+ low risk files)
Ad-Aware SE Build 1.06r1
Logfile Created on:02 March 2007 13:36:27
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R155 26.02.2007
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):35 total references
Possible Browser Hijack attempt(TAC index:3):8 total references
SpyDawn(TAC index:3):18 total references
Starware Toolbar(TAC index:5):4 total references
Tracking Cookie(TAC index:3):75 total references
Win32.Trojandownloader.Zlob(TAC index:10):18 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects
02-03-2007 13:36:27 - Scan started. (Full System Scan)
MRU List Object Recognized!
Location: : C:\Documents and Settings\DELL\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office
MRU List Object Recognized!
Location: : C:\Documents and Settings\DELL\recent
Description : list of recently opened documents
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d
MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d
MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X
MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X
MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X
MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\mediaplayer\player\recentfilelist
Description : list of recently used files in microsoft windows media player
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\mediaplayer\preferences
Description : last playlist index loaded in microsoft windows media player
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\microsoft management console\recent file list
Description : list of recent snap-ins used in the microsoft management console
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\office\10.0\common\open find\microsoft powerpoint\settings\insert picture\file name mru
Description : list of recent pictured inserted in microsoft powerpoint
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\office\10.0\common\open find\microsoft word\settings\open\file name mru
Description : list of recent documents opened by microsoft word
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\office\10.0\common\open find\microsoft word\settings\save as\file name mru
Description : list of recent documents saved by microsoft word
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\office\10.0\excel\recent files
Description : list of recent files used by microsoft excel
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\windows\currentversion\applets\paint\recent file list
Description : list of files recently opened using microsoft paint
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\windows\currentversion\applets\regedit
Description : last key accessed using the microsoft registry editor
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\windows\currentversion\applets\wordpad\recent file list
Description : list of recent files opened using wordpad
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\realnetworks\realplayer\6.0\preferences
Description : list of recent skins in realplayer
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\realnetworks\realplayer\6.0\preferences
Description : list of recent clips in realplayer
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\realnetworks\realplayer\6.0\preferences
Description : last login time in realplayer
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk
MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general
Description : windows media sdk
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\windows media\wmsdk\general
Description : windows media sdk
MRU List Object Recognized!
Location: : S-1-5-21-1630991506-1555798824-406382136-1006\software\winrar\dialogedithistory\extrpath
Description : winrar "extract-to" history
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 556
ThreadCreationTime : 02-03-2007 12:54:24
BasePriority : Normal
#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 608
ThreadCreationTime : 02-03-2007 12:54:25
BasePriority : Normal
#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 632
ThreadCreationTime : 02-03-2007 12:54:26
BasePriority : High
#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 676
ThreadCreationTime : 02-03-2007 12:54:27
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : services.exe
#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 688
ThreadCreationTime : 02-03-2007 12:54:27
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe
#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 856
ThreadCreationTime : 02-03-2007 12:54:27
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 932
ThreadCreationTime : 02-03-2007 12:54:27
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1028
ThreadCreationTime : 02-03-2007 12:54:27
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:9 [savservice.exe]
FilePath : C:\Program Files\Sophos\Sophos Anti-Virus\
ProcessID : 1076
ThreadCreationTime : 02-03-2007 12:54:27
BasePriority : Normal
FileVersion : 1.0.0.1060
ProductVersion : 6.0.6
ProductName : Sophos Anti-Virus
CompanyName : Sophos Plc
FileDescription : Performs virus scanning and disinfection functions
InternalName : Infrastructure.dll
LegalCopyright : © 1989-2006 Sophos Plc, www.sophos.com
OriginalFilename : Infrastructure.dll
#:10 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1292
ThreadCreationTime : 02-03-2007 12:54:28
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:11 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1400
ThreadCreationTime : 02-03-2007 12:54:28
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:12 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 1444
ThreadCreationTime : 02-03-2007 12:54:28
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE
#:13 [vsmon.exe]
FilePath : C:\WINDOWS\system32\ZoneLabs\
ProcessID : 1456
ThreadCreationTime : 02-03-2007 12:54:28
BasePriority : Normal
FileVersion : 6.5.737.000
ProductVersion : 6.5.737.000
ProductName : TrueVector Service
CompanyName : Zone Labs, LLC
FileDescription : TrueVector Service
InternalName : vsmon
LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC
OriginalFilename : vsmon.exe
#:14 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1816
ThreadCreationTime : 02-03-2007 12:54:32
BasePriority : Normal
FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
ProductVersion : 5.1.2600.2696
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe
#:15 [atkkbservice.exe]
FilePath : C:\WINDOWS\
ProcessID : 1992
ThreadCreationTime : 02-03-2007 12:54:38
BasePriority : Normal
FileVersion : 1, 0, 1, 0
ProductVersion : 1, 0, 1, 0
ProductName : ASUS Keyboard Service
CompanyName : ASUSTeK COMPUTER INC.
FileDescription : ASUS Keyboard Service
InternalName : ATKKBService
LegalCopyright : Copyright © 2004 @ASUSTeK COMPUTER INC.
OriginalFilename : ATKKBService.exe
#:16 [sqlservr.exe]
FilePath : C:\Program Files\Microsoft SQL Server\MSSQL\Binn\
ProcessID : 2036
ThreadCreationTime : 02-03-2007 12:54:38
BasePriority : Normal
FileVersion : 2000.080.0194.00
ProductVersion : 8.00.194
ProductName : Microsoft SQL Server
CompanyName : Microsoft Corporation
FileDescription : SQL Server Windows NT
InternalName : SQLSERVR
LegalCopyright : © 1988-2000 Microsoft Corp. All rights reserved.
LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation. Windows™ is a trademark of Microsoft Corporation
OriginalFilename : SQLSERVR.EXE
Comments : NT INTEL X86
#:17 [nvsvc32.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 188
ThreadCreationTime : 02-03-2007 12:54:41
BasePriority : Normal
FileVersion : 6.14.10.9147
ProductVersion : 6.14.10.9147
ProductName : NVIDIA Driver Helper Service, Version 91.47
CompanyName : NVIDIA Corporation
FileDescription : NVIDIA Driver Helper Service, Version 91.47
InternalName : NVSVC
LegalCopyright : © NVIDIA Corporation. All rights reserved.
OriginalFilename : nvsvc32.exe
#:18 [savadminservice.exe]
FilePath : C:\Program Files\Sophos\Sophos Anti-Virus\
ProcessID : 212
ThreadCreationTime : 02-03-2007 12:54:41
BasePriority : Normal
FileVersion : 1.0.0.1060
ProductVersion : 6.0.6
ProductName : Sophos Anti-Virus
CompanyName : Sophos Plc
FileDescription : Sophos Administrator Service
InternalName : SavAdminService.exe
LegalCopyright : © 1989-2006 Sophos Plc, www.sophos.com
OriginalFilename : SavAdminService.exe
#:19 [alsvc.exe]
FilePath : C:\Program Files\Sophos\AutoUpdate\
ProcessID : 248
ThreadCreationTime : 02-03-2007 12:54:41
BasePriority : Normal
FileVersion : 3.7.18.129
ProductVersion : 2.1.1
ProductName : Sophos AutoUpdate
CompanyName : Sophos Plc
FileDescription : Sophos AutoUpdate Service.
InternalName : ALSvc.exe
LegalCopyright : © 2003-2006 Sophos Plc, www.sophos.com
OriginalFilename : ALSvc.exe
#:20 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 308
ThreadCreationTime : 02-03-2007 12:54:41
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:21 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 144
ThreadCreationTime : 02-03-2007 12:54:44
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe
#:22 [jusched.exe]
FilePath : C:\Program Files\Java\jre1.5.0_10\bin\
ProcessID : 360
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
#:23 [stsystra.exe]
FilePath : C:\WINDOWS\
ProcessID : 1968
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
FileVersion : 1.0.5143.0 nd491 cp1
ProductVersion : 1.0.5143.0 nd491 cp1
ProductName : C-Major Audio
CompanyName : SigmaTel, Inc.
FileDescription : Sigmatel Audio system tray application
InternalName : stsystray.exe
LegalCopyright : Copyright © 2004-2006, SigmaTel, Inc.
OriginalFilename : stsystray.exe
#:24 [dmxlauncher.exe]
FilePath : C:\Program Files\Dell\Media Experience\
ProcessID : 1652
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
#:25 [issch.exe]
FilePath : C:\Program Files\Common Files\InstallShield\UpdateService\
ProcessID : 2064
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
FileVersion : 4, 50, 100, 33433
ProductVersion : 4, 50
ProductName : InstallShield Update Service
CompanyName : InstallShield Software Corporation
FileDescription : InstallShield Update Service Scheduler
InternalName : Scheduler
LegalCopyright : Copyright © 1990-2004 InstallShield Software Corporation
OriginalFilename : issch.exe
#:26 [dlactrlw.exe]
FilePath : C:\WINDOWS\System32\DLA\
ProcessID : 2076
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
FileVersion : 5.20.08a
CompanyName : Sonic Solutions
FileDescription : Drive Letter Access Component
LegalCopyright : Copyright © 2004 Sonic Solutions
#:27 [rundll32.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 2104
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Run a DLL as an App
InternalName : rundll
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : RUNDLL.EXE
#:28 [zlclient.exe]
FilePath : C:\Program Files\Zone Labs\ZoneAlarm\
ProcessID : 2136
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
FileVersion : 6.5.737.000
ProductVersion : 6.5.737.000
ProductName : Zone Labs Client
CompanyName : Zone Labs, LLC
FileDescription : Zone Labs Client
InternalName : zlclient
LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC
OriginalFilename : zlclient.exe
#:29 [trayicon.exe]
FilePath : C:\Program Files\AGEIA Technologies\
ProcessID : 2144
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
#:30 [ituneshelper.exe]
FilePath : C:\Program Files\iTunes\
ProcessID : 2164
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
FileVersion : 7.0.2.16
ProductVersion : 7.0.2.16
ProductName : iTunes
CompanyName : Apple Computer, Inc.
FileDescription : iTunesHelper Module
InternalName : iTunesHelper
LegalCopyright : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
OriginalFilename : iTunesHelper.exe
#:31 [qttask.exe]
FilePath : C:\Program Files\QuickTime\
ProcessID : 2208
ThreadCreationTime : 02-03-2007 12:54:46
BasePriority : Normal
FileVersion : 7.1.5a38
ProductVersion : QuickTime 7.1.5a38
ProductName : QuickTime
CompanyName : Apple Computer, Inc.
FileDescription : QuickTime Task
InternalName : QuickTime Task
LegalCopyright : Copyright Apple Computer, Inc. 1989-2007
OriginalFilename : QTTask.exe
#:32 [dsagnt.exe]
FilePath : C:\Program Files\Dell Support\
ProcessID : 2240
ThreadCreationTime : 02-03-2007 12:54:47
BasePriority : Below Normal
FileVersion : 2, 1, 3, 173
ProductVersion : 2, 1, 3, 173
ProductName : Dell Support
CompanyName : Gteko Ltd.
FileDescription : Dell Support
InternalName : AUAgent
LegalCopyright : Copyright © 2000 - 2006 Gteko Ltd.
OriginalFilename : AUAgent.exe
#:33 [ctfmon.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 2276
ThreadCreationTime : 02-03-2007 12:54:47
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE
#:34 [googletoolbarnotifier.exe]
FilePath : C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\
ProcessID : 2300
ThreadCreationTime : 02-03-2007 12:54:47
BasePriority : Normal
FileVersion : 1, 2, 908, 5008
ProductVersion : 1, 2, 908, 5008
ProductName : GoogleToolbarNotifier
CompanyName : Google Inc.
FileDescription : GoogleToolbarNotifier
LegalCopyright : Copyright © 2005-2006
OriginalFilename : GoogleToolbarNotifier.exe
#:35 [spywarebegone.exe]
FilePath : C:\spywarebegone\
ProcessID : 2332
ThreadCreationTime : 02-03-2007 12:54:47
BasePriority : Normal
FileVersion : 9.20.1.2
ProductVersion : Version 9
ProductName : Spyware BeGone!
CompanyName : MicroSmarts LLC.
FileDescription : Locate Spies and Adware Then Clean It.
InternalName : Spyware BeGone!
LegalCopyright : MicroSmarts LLC.
LegalTrademarks : Spyware BeGone!
OriginalFilename : SpywareBeGone.exe
Comments : Program By Tarek Hussein.
#:36 [almon.exe]
FilePath : C:\Program Files\Sophos\AutoUpdate\
ProcessID : 2604
ThreadCreationTime : 02-03-2007 12:54:49
BasePriority : Normal
FileVersion : 3.8.49.127
ProductVersion : 2.1.0
ProductName : Sophos AutoUpdate
CompanyName : Sophos Plc
FileDescription : Component to show AutoUpdate's GUI elements.
InternalName : ALMon.exe
LegalCopyright : © 2003-2006 Sophos Plc, www.sophos.com
OriginalFilename : ALMon.exe
#:37 [ipodservice.exe]
FilePath : C:\Program Files\iPod\bin\
ProcessID : 2628
ThreadCreationTime : 02-03-2007 12:54:49
BasePriority : Normal
FileVersion : 7.0.2.16
ProductVersion : 7.0.2.16
ProductName : iTunes
CompanyName : Apple Computer, Inc.
FileDescription : iPodService Module
InternalName : iPodService
LegalCopyright : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
OriginalFilename : iPodService.exe
#:38 [sqlmangr.exe]
FilePath : C:\Program Files\Microsoft SQL Server\80\Tools\Binn\
ProcessID : 2656
ThreadCreationTime : 02-03-2007 12:54:50
BasePriority : Normal
FileVersion : 2000.080.0194.00
ProductVersion : 8.00.194
ProductName : Microsoft SQL Server
CompanyName : Microsoft Corporation
FileDescription : SQL Server Service Manager
InternalName : SQLMANGR
LegalCopyright : © 1988-2000 Microsoft Corp. All rights reserved.
LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation. Windows™ is a trademark of Microsoft Corporation
OriginalFilename : SQLMANGR.exe
Comments : NT INTEL X86
#:39 [itunes.exe]
FilePath : C:\Program Files\iTunes\
ProcessID : 3936
ThreadCreationTime : 02-03-2007 13:07:45
BasePriority : Normal
FileVersion : 7.0.2.16
ProductVersion : 7.0.2.16
ProductName : iTunes
CompanyName : Apple Computer, Inc.
FileDescription : iTunes
InternalName : iTunes
LegalCopyright : © 2003-2006 Apple Computer, Inc. All Rights Reserved.
OriginalFilename : iTunes.exe
#:40 [lastfm.exe]
FilePath : C:\Program Files\Last.fm\
ProcessID : 2472
ThreadCreationTime : 02-03-2007 13:07:49
BasePriority : Normal
#:41 [iexplore.exe]
FilePath : C:\Program Files\Internet Explorer\
ProcessID : 1152
ThreadCreationTime : 02-03-2007 13:27:07
BasePriority : Normal
FileVersion : 7.00.6000.16414 (vista_gdr.070108-1520)
ProductVersion : 7.00.6000.16414
ProductName : Windows® Internet Explorer
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : IEXPLORE.EXE
#:42 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 2688
ThreadCreationTime : 02-03-2007 13:35:45
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 35
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{189518df-7eba-4d31-a7e1-73b5bb60e8d5}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{23d627fe-3f02-44cf-9ee1-7b9e44bd9e13}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{43cfefbe-8ae4-400e-bbe4-a2b61bb140fb}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{5790b963-23c5-43c1-bcf5-01c9b5a3e44e}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{5d42ddf4-81eb-4668-9951-819a1d5befc8}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{76d06077-d5d3-40ca-b32d-6a67a7ff3f06}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{86c7e6c3-ec47-44e5-aa08-ee0d0a25895f}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{9283dac1-43f5-4580-bf86-841f22af2335}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{ae90cafc-09d4-47f0-9e11-ce621c424f08}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{ba397e39-f67f-423f-bc6e-65939450093a}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{bec8a83d-01d4-4f15-b8a9-4b4ab24253a7}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{c4eedc19-992d-409a-b323-ed57d511afa5}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{dd90f677-d205-4f70-9014-659614aabcb2}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{e3df91f3-f24f-441e-9001-d61f36024322}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f459eadb-5903-48d5-864c-2b7b46ab1424}
SpyDawn Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Misc
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{fc4edf66-0547-4f1a-ae96-7cfcad711c90}
Starware Toolbar Object Recognized!
Type : Regkey
Data :
TAC Rating : 5
Category : Adware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{45a4902e-4479-4eae-a186-8d0f7e4c78de}
Starware Toolbar Object Recognized!
Type : Regkey
Data :
TAC Rating : 5
Category : Adware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{9a7d6ad2-0881-451f-bb27-f5e2ee2c5b14}
Win32.Trojandownloader.Zlob Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{84938242-5c5b-4a55-b6b9-a1507543b418}
Win32.Trojandownloader.Zlob Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{67982bb7-0f95-44c5-92dc-e3af3dc19d6d}
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 20
Objects found so far: 55
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Possible Browser Hijack attempt Object Recognized!
Type : Regkey
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Possible Browser Hijack attempt Object Recognized!
Type : RegValue
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Value : UninstallString
Possible Browser Hijack attempt Object Recognized!
Type : RegValue
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Value : HelpLink
Possible Browser Hijack attempt Object Recognized!
Type : RegValue
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Value : Publisher
Possible Browser Hijack attempt Object Recognized!
Type : RegValue
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Value : URLInfoAbout
Possible Browser Hijack attempt Object Recognized!
Type : RegValue
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Value : Contact
Possible Browser Hijack attempt Object Recognized!
Type : RegValue
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Value : Comments
Possible Browser Hijack attempt Object Recognized!
Type : RegValue
Data : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist "http://www.gamehouse.com/"
TAC Rating : 10
Category : Malware
Comment : (http://www.gamehouse.com/)
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\Uninstall\Super TextTwist
Value : DisplayIcon
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 8
Objects found so far: 63
Win32.Trojandownloader.Zlob Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_USERS
Object : S-1-5-21-1630991506-1555798824-406382136-1006\software\microsoft\internet explorer\toolbar\Webbrowser
Value : {84938242-5c5b-4a55-b6b9-a1507543b418}
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : dell@zedo[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:8
Value : Cookie:dell@zedo.com/
Expires : 27-02-2017 13:26:10
LastSync : Hits:8
UseCount : 0
Hits : 8
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : dell@ads.pointroll[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:8
Value : Cookie:dell@ads.pointroll.com/
Expires : 01-01-2010
LastSync : Hits:8
UseCount : 0
Hits : 8
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : dell@ad.yieldmanager[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:343
Value : Cookie:dell@ad.yieldmanager.com/
Expires : 14-08-2017
LastSync : Hits:343
UseCount : 0
Hits : 343
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : dell@adopt.euroclick[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:2
Value : Cookie:dell@adopt.euroclick.com/
Expires : 25-02-2017 19:18:44
LastSync : Hits:2
UseCount : 0
Hits : 2
Its a bit of a blurr now, coz ive been off the ocmputer now, but im getting a 'System Alert!' pop-up stating; that i have a number of spyware applications that may impact the performance on the computer,
