# I think i have i virus,i dont know,someone please help!!!!



## luisa (Aug 29, 2005)

Hi,can someone help me please,i think my computer has a virus.My Norton Anti Virus 2005 cannot be activated because i do not have the product key.It has not been activated for weeks now.Everytime i want to search for information on the net it seems to freez for a while than starts searching i really do not know what is goin on,but i do think my computer is infected with a virus.Pease Help!


----------



## Cheeseball81 (Mar 3, 2004)

Click here to download *HJTsetup.exe*: http://www.thespykiller.co.uk/files/HJTSetup.exe
Save HJTsetup.exe to your desktop.

Double click on the HJTsetup.exe icon on your desktop.
By default it will install to *C:\Program Files\Hijack This*.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
Click on the *Do a system scan and save a log file* button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
*DO NOT* have Hijack This fix anything yet. Most of what it finds will be harmless or even required.


----------



## luisa (Aug 29, 2005)

Hi,Here is my HJT LOG:

Logfile of HijackThis v1.99.1
Scan saved at 6:03:34 PM, on 15/11/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.03.0000.1005\EN-AU\MSNAPPAU.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\MACROMED\FLASH\GETFLASH.EXE
C:\PROGRAM FILES\HIJACKTHIS1991.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.planetprepaid.com.au
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.au/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\EN-AU\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.03.0000.1005\EN-XU\STMAIN.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\EN-AU\MSNTB.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - User Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - User Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab
O16 - DPF: DigiChat Applet - http://host4.digichat.com/DigiChat/DigiClasses/Client_IE.cab


----------



## Cheeseball81 (Mar 3, 2004)

Nothing bad showing in the log.

Run *ActiveScan* online virus scan:
http://www.pandasoftware.com/products/activescan.htm

When the scan is finished, anything that it cannot clean have it delete it. 
Make a note of the file location of anything that cannot be deleted so you can delete it yourself.
Save the results from the scan.

Post the results here.


----------



## 911 (Mar 26, 2003)

Have you tried to contact Norton about the missing Product key ? Download and run the free Anti-virus program AVG-7 from 
http://free.grisoft.com/doc/1/lng/us/tpl/v5.


----------



## luisa (Aug 29, 2005)

Incident Status Location 

Virus:W32/Parite.B Disinfected Operating system 
Spyware:spyware/marketscore No disinfected C:\WINDOWS\SYSTEM\rk.exe 
Adware:adware/adsmart No disinfected C:\WINDOWS\SYSTEM\vx.tll 
Adware:adware/navipromo No disinfected C:\WINDOWS\SYSTEM\msclock32.dll 
Spyware:spyware/smitfraud No disinfected C:\WINDOWS\SYSTEM\wp.bmp 
Dialer:dialer.b No disinfected C:\WINDOWS\DOWNLOADED PROGRAM FILES\EGDACCESS.inf 
Adware:adware/ist.yoursitebar No disinfected C:\WINDOWS\DOWNLOADED PROGRAM FILES\YSBactivex.dll 
Spyware:spyware/new.net No disinfected C:\WINDOWS\NDNuninstall6_38.exe 
Adware:adware/webhancer No disinfected C:\PROGRAM FILES\whInstall 
Adware:adware/surfaccuracy No disinfected C:\PROGRAM FILES\SurfAccuracy 
Adware:adware/wupd No disinfected Windows Registry 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CFGWIZ32.EXE  
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\OOBE\MSOOBE.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\DPLAYSVR.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\icwscrpt.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\WRKGADM.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\DCOM98\OLDOLE\UNINSTAL.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\ACTMOVIE.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\ADDREG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CLICONFG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CMDL32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CMMGR32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CMMON32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CMSTP.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\DLLHOST.EXE


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\DSSSIG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\ESSERVER.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\FONTREG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\IE4UINIT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\INTERNAT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\JDBGMGR.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\LIGHTS.EXE 
Virus:W32/Parite.B  Disinfected C:\WINDOWS\SYSTEM\LOADWC.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MSHTA.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\ODBCAD32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\ODBCCONF.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\PSTORES.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\REDIR32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\REGSVR32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\RPCSS.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CKCNV.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\SUCATREG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MACROMED\FLASH\GETFLASH.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\IMGSTART.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MKCOMPAT.EXE  
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MSCONFIG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\REGWIZ.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\RNAAPP.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\SFC.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\SPOOL32.EXE


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\STIMON.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\TAPI16.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\TAPIINI.EXE  
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\TAPISRV.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\TAPIUPR.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\TCMSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\TLOCMGR.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\WALIGN.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\msiexec.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\AWFXEX32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\BPCPOST.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MNMSRVC.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\LOCPROXY.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MAPISRVR.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MDISP32.EXE 
Virus:W32/Parite.B  Disinfected C:\WINDOWS\SYSTEM\LOCPRXY2.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\RSVP.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\Flying Windows.scr 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\3D Text.scr 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\USERSTUB.EXE


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\updcrl.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\mstinit.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\sage.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\unam4ie.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\rk.exe 
Adware:Adware/Fastvideoplayer No disinfected C:\WINDOWS\SYSTEM\vmplay.dll 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\logagent.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\MAPISP32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CNFNOT32.EXE  
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\CONVDSN.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\QuickTime\QuickTimeUpdateHelper.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\QuickTime\QTPluginInstaller.exe 
Dialerialer.CWI No disinfected C:\WINDOWS\SYSTEM\msclock32.dll 
Dialerialer.CWI No disinfected C:\WINDOWS\SYSTEM\msplock32.dll 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\nvsvc.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\DXDIAG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\wosmvcptfa.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\dpnsvr.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\dpvsetup.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\DirectX\Migrate\dpvhelp.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\dmcpl.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\nwiz.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\keystone.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSTEM\wapumzor.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\INF\unregmp2.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\HWINFO.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\MPLAYER.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\COMMAND\CSCRIPT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\COMMAND\SULFNBK.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\COMMAND\START.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\CLSPACK.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\DRWATSON.EXE


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\WINDOWS\EXTRAC32.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\FONTVIEW.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\GRPCONV.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\MSNMGSR1.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\PIDSET.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SETDEBUG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SIGVERIF.EXE 
Virus:W32/Parite.B  Disinfected C:\WINDOWS\UPWIZUN.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WINREP.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\JVIEW.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WEB\Wallpaper\Living Waterfalls Wallpaper #1 dir\uninstall.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WEB\Wallpaper\LIVING WATERFALLS WALLPAPER #1.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WEB\Wallpaper\Living Beaches 2 dir\uninstall.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WEB\Wallpaper\Living Waterfalls Wallpaper #2 dir\uninstall.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WEB\Wallpaper\Living Coral Wallpaper #1 dir\uninstall.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WSCRIPT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\ACCSTAT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\ASD.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\CVTAPLOG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\MM2ENT.EXE  
Virus:W32/Parite.B Disinfected C:\WINDOWS\PACKAGER.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\PBRUSH.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\REGEDIT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\RG2CATDB.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\OPTIONS\CABS\CARPSERV.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\TASKMAN.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\TASKMON.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\VCMUI.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WRITE.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\KODAKPRV.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\MSNCREAT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\TOUR98.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\TWUNK_32.EXE  
Virus:W32/Parite.B Disinfected C:\WINDOWS\REGTLIB.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\TEMP\setup_wm.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSBCKUP\MPLAYER.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSBCKUP\DDHELP.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SYSBCKUP\DPLAYSVR.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\NETSTAT.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\PING.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\TELNET.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\TRACERT.EXE


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\WINDOWS\WINIPCFG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\IPCONFIG.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Channel Screen Saver.SCR 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Application Data\Microsoft\WELCOME\WELDATA.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\ArcaClean.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\nsb-setup.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\boohsv foilder\My Pictures\waterfalls1awfree.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\boohsv foilder\My Pictures\marine2free.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\boohsv foilder\My Pictures\living gardens.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\boohsv foilder\My Pictures\Living Waterfalls Wallpaper #1\undata.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\boohsv foilder\My Pictures\Living Waterfalls Wallpaper #1\UNINSTAL.EXE  
Virus:W32/Parite.B Disinfected C:\WINDOWS\Desktop\boohsv foilder\My Pictures\Living Waterfalls Wallpaper #1\setwallpaper.exe 
Adware:Adware/IST.ISTBar No disinfected C:\WINDOWS\Downloaded Program Files\YSBactivex.dll 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Temporary Internet Files\Content.IE5\2NO14BQ7\IE6.0sp1-KB896688-Windows-98-ME-x86-ENU_db46ed858e73221e45ff648dda5ddb4[1].exe 
Virus:Exploit/LoadImage Disinfected C:\WINDOWS\Temporary Internet Files\Content.IE5\2NO14BQ7\netv[1].anr 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Temporary Internet Files\Content.IE5\F8ILU54W\msjavwu_8073687b82d41db93f4c2a04af2b34d[1].exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Temporary Internet Files\Content.IE5\MJMB2IN5\WindowsME.Windows98SE-KB904706-DX8-x86-ENU_0a2fee19782a9b6d8b517e07f800525[1].exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Temporary Internet Files\Content.IE5\89ABCDEF\MPSetup[1].exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\WJVIEW.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\IsUninst.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Ctregrun.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\SLRUNDLL.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\ieuninst.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Windows Update Setup Files\ie6setup.exe  
Virus:W32/Parite.B Disinfected C:\WINDOWS\oeuninst.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\hh.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\flashax.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Cache\Adobe Reader 6.0.1\ENUBIG\instmsia.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Cache\Adobe Reader 6.0.1\ENUBIG\instmsiw.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Cache\Adobe Reader 6.0.1\ENUBIG\setup.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\uneng.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\NDNuninstall6_38.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\UninstallFirefox.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Tranquil - Waterfalls.scr 
Virus:W32/Parite.B Disinfected C:\WINDOWS\unvise32qt.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boohsv\Application Data\Microsoft\WELCOME\WELDATA.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\LB\Application Data\Microsoft\WELCOME\WELDATA.EXE 
Dialerialer.B No disinfected C:\WINDOWS\Profiles\boo\Application Data\Mozilla\Firefox\Profiles\default.s77\Cache\A842974Ad01 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\Application Data\Microsoft\Installer\{6E234F6E-0828-405B-8776-2777EA315945}\ARPPRODUCTICON.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\Application Data\Microsoft\Installer\{6E234F6E-0828-405B-8776-2777EA315945}\NewShortcut1_6E234F6E0828405B87762777EA315945.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\Application Data\Microsoft\Installer\{6E234F6E-0828-405B-8776-2777EA315945}\NewShortcut2_6E234F6E0828405B87762777EA315945_1.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\Application Data\Microsoft\WELCOME\WELDATA.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\waterfalls1awfree.exe


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\marine2free.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\living gardens.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\stormfree.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\wpwater2.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\wpbeaches2.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\wpwater3.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\My Pictures\coral1awfree.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\Profiles\boo\My Documents\rp8-setup.exe  
Virus:W32/Parite.B Disinfected C:\WINDOWS\LOADQM.EXE 
Virus:W32/Parite.B Disinfected C:\WINDOWS\AolCInUn.exe 
Virus:W32/Parite.B Disinfected C:\WINDOWS\aolback.exe 
Virus:W32/Parite.B Disinfected C:\CONEXANT\HSFSETUP\HXFSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSINFO32.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Microsoft Shared\Orgchart\ORGCHART.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Microsoft Shared\Artgalry\ARTGALRY.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\SymSetup\{C6F5B6CF-609C-428E-876F-CA83176C021B}.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\LiveReg\IRALRSHL.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\LiveReg\SYMCSUB.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\LiveReg\VCCLNUP.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\LiveReg\VCSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\IDS\IdsInst.exe  
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\NMain.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\SNDSRVC.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\SNDInst.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\SMNLnch.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMDTR.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\VirusDefs\20040811.020\DEFINST.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\VirusDefs\20050814.017\DEFINST.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\VirusDefs\20050824.008\DEFINST.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\VirusDefs\20050826.018\DEFINST.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\CCLGVIEW.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\Symantec Shared\CCPWDSVC.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKERNEL.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\CREATIVE\AUDIO\CTSetup\ctsetup.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\AIEPR\UNWISE.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\AIEPR\aiepr.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\PLUS!\SYSAGENT.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Online Services\MSN50\MSNBOOT.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Online Services\AOL\AOLSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Online Services\CompuServe\CSSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Accessories\MSPAINT.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Accessories\WORDPAD.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Setup\SETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Setup\IEBATCH.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Connection Wizard\ICWOOBE.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\Connection Wizard\isignup.exe 
Virus:W32/Parite.B  Disinfected C:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\W2K\expinst.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\DW15.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Explorer\ie6setup.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\NetMeeting\CONF.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\NetMeeting\WB32.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Outlook Express\msimn.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Outlook Express\wab.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Outlook Express\setup50.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Outlook Express\wabmig.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Outlook Express\oemig50.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Media Player\logagent.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Media Player\wmplayer.exe  
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Media Player\migrate.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Media Player\dw15.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Media Player\Installer\mpsetup[1].exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Media Player\setup_wm.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Media Player\Roxio\wmburn.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Spybot - Search & Destroy\unins000.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Spybot - Search & Destroy\blindman.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Spybot - Search & Destroy\Update.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\LUInit.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\LUALL.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\Luupdate.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\Lusetup-lt.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Symantec\LiveUpdate\DISreboot.exe


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Printme\ConsoleApp.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Adobe\Acrobat 6.0\Reader\AdobeUpdateManager.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Adobe\Acrobat 6.0\Reader\Updater\acroaum.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\WinZip\WZSEPE32.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\WinZip\WINZIP32.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\LRSend.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\IWP\ALEUpdat.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\CfgWiz.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\CCIMSCN.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\NAVW32.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\QCONSOLE.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\SAVSCAN.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\BOOTWARN.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\NAVSTUB.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\NAVWNT.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Norton AntiVirus\OPSCAN.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\InstallShield Installation Information\{10798AE3-DCBB-43C3-9C93-C23512427E25}\Setup.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\EXCEL.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\SCHDPL32.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\GRAPH8.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\WINWORD.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\OSA.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\POWERPNT.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\FINDER.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\SENDFILE.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Microsoft Office\Office\FINDFAST.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Messaging\NEWPROF.EXE  
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Messaging\SCANPST.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Windows Messaging\EXCHNG32.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\QuickTime\QTInfo.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\QuickTime\PictureViewer.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\QuickTime\QuickTimePlayer.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\QuickTime\QuickTimeUpdater.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\MSN Messenger\dw.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\MSN Messenger\msmsgs.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims\Sims.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims\UserData\Web Templates\Localization_Templates\Tokin.exe


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims\EReg\The Sims Deluxe Edition_Code.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims\EReg\The Sims Deluxe Edition_EZ.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims\EReg\The Sims Deluxe Edition_eReg.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims\EReg\The Sims Deluxe Edition_uninst.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims\EReg\go_ez.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Maxis\The Sims Creator\TheSimsCreator.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-au\msnappau.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-au\au_os.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-au\mtbs.exe  
Virus:W32/Parite.B Disinfected C:\Program Files\Real\RealPlayer\~Upg0\playinst_aupackage.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\hijackthis1991.exe 
Dialerialer.B No disinfected C:\Program Files\backups\backup-20051006-193312-733.inf 
Dialerialer.B No disinfected C:\Program Files\backups\backup-20051006-193312-733.dll 
Adware:Adware/WUpd No disinfected C:\Program Files\backups\backup-20051112-192432-779.dll 
Virus:W32/Parite.B Disinfected C:\Program Files\CCleaner\uninst.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Lavasoft\Ad-Aware SE Personal\unregaaw.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\SpywareGuard\unins000.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Twinternals\Protected Storage Explorer\PSExplorer.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Mozilla Firefox\components\talkback.exe  
Virus:W32/Parite.B Disinfected C:\Program Files\Mozilla Firefox\xpicleanup.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Mozilla Firefox\firefox.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Mozilla Firefox\uninstall\UninstallFirefox.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee.com\Shared\MCAPPINS.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee.com\Shared\mghtml.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee.com\Agent\mcagent.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee.com\Agent\mcdash.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee.com\Agent\mcupdmgr.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee.com\Agent\mcupdui.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee.com\Agent\McRegWiz.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\SymNetDrv\SNDMon.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\Eula.exe 
Virus:W32/Parite.B  Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\instmsia.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\instmsiw.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\MSC\Eula.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\MSC\McAppins.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\MSC\setup.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\RGW\McRegWiz.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee AntiSpyware 1.00 Install\setup.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\McAfee\McAfee AntiSpyware\Msscli.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\WallpaperSS\unins000.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Freeze.com\Living Waterfalls Wallpaper #1\undata.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Freeze.com\Living Waterfalls Wallpaper #1\UNINSTAL.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Freeze.com\Living Waterfalls Wallpaper #1\setwallpaper.exe  
Virus:W32/Parite.B Disinfected C:\Program Files\Screensavers.com\Wallpaper\swpstart.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Infogrames\Addiction Pinball\UNWISE.EXE 
Virus:W32/Parite.B Disinfected C:\Program Files\Infogrames\Addiction Pinball\pincfg.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\KaZaA Media Finder 2.0\media\kazaalite.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\KaZaA Media Finder 2.0\unins000.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\KaZaA Media Finder 2.0\kmf2.0.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\KaZaA Media Finder 2.0\sig2dat.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Outlook Password Recovery Master\unins000.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Outlook Password Recovery Master\OPasRec.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Password Recovery Toolbox\unins000.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Internet Password Recovery Toolbox\IPRTbox.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Passware\demos\un-iekeyd.exe 
Virus:W32/Parite.B Disinfected C:\Program Files\Passware\demos\iekey.exe 
Virus:W32/Parite.B Disinfected C:\NVIDIA\Win9x\44.03\DMCPL.exe 
Virus:W32/Parite.B Disinfected C:\NVIDIA\Win9x\44.03\keystone.exe 
Virus:W32/Parite.B Disinfected C:\NVIDIA\Win9x\44.03\nvsvc.exe


----------



## Cheeseball81 (Mar 3, 2004)

Most, if not all of them have been disinfected so that's good.

Download *KillBox* here: http://www.downloads.subratam.org/KillBox.zip
Save it to your desktop.
*DO NOT* run it yet.

Reboot into *Safe Mode*.
Restart your computer and as soon as it starts booting up again continuously tap *F8*. 
A menu should come up where you will be given the option to enter Safe Mode.

Double-click on Killbox.exe to run it. 
Now put a tick by Standard File Kill. 
In the "*Full Path of File to Delete*" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. 
It will ask for confimation to delete the file. 
Click Yes. 
Continue with that same procedure until you have copied and pasted all of these in the "*Paste Full Path of File to Delete*" box.

*C:\WINDOWS\SYSTEM\rk.exe 
C:\WINDOWS\SYSTEM\vx.tll 
C:\WINDOWS\SYSTEM\msclock32.dll 
C:\WINDOWS\SYSTEM\wp.bmp 
C:\WINDOWS\DOWNLOADED PROGRAM FILES\EGDACCESS.inf 
C:\WINDOWS\DOWNLOADED PROGRAM FILES\YSBactivex.dll 
C:\WINDOWS\NDNuninstall6_38.exe 
C:\WINDOWS\SYSTEM\msplock32.dll 
C:\WINDOWS\SYSTEM\vmplay.dll *

*Note*: It is possible that Killbox will tell you that one or more files do not exist. 
If that happens, just continue on with all the files. Be sure you don't miss any.

Exit the KillBox.

Find and delete these folders:

*C:\PROGRAM FILES\whInstall 
C:\PROGRAM FILES\SurfAccuracy *

Also in Safe Mode navigate to the *C:\Windows\Temp* folder. 
Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Go to Start > Run and type *%temp%* in the Run box. 
The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. 
On the General tab under "Temporary Internet Files" Click "Delete Files". 
Put a check by "Delete Offline Content" and click OK. 
Click on the Programs tab then click the "Reset Web Settings" button. 
Click Apply then OK.

Empty the Recycle Bin.

Reboot, post a new Hijack This log.


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\NVIDIA\Win9x\44.03\nwiz.exe 
Virus:W32/Parite.B Disinfected C:\NVIDIA\Win9x\44.03\Setup.exe 
Virus:W32/Parite.B Disinfected C:\System_drivers\NIC\PCI_DATA.EXE 
Virus:W32/Parite.B Disinfected C:\System_drivers\NIC\PREINSTL.EXE 
Virus:W32/Parite.B Disinfected C:\System_drivers\AUDIO_DRIVER\SBAUDIOSetupus.exe 
Virus:W32/Parite.B Disinfected C:\System_drivers\HSFp_Win98SE\HXFSetup.exe 
Virus:W32/Parite.B Disinfected C:\System_drivers\service_pack\sesp201en.exe 
Virus:W32/Parite.B Disinfected C:\Downloads\winzip90.exe 
Virus:W32/Parite.B Disinfected C:\Downloads\spybotsd14.exe 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\CDSTART.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAVSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SYMSC\SYMWMIAV\SYMSC\USRPRMPT.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SYMNET\SYMNET\SYMSHARE\SNDINST.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SYMNET\SYMNET\SYMSHARE\SNDSRVC.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SYMNET\SYMNET\SYMSHARE\IDS\IDSINST.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SYMLNCH\SYMLNCH.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SPBBC\COMMON\SYMSHARE\SPBBC\SPBBCSVC.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SPBBC\COMMON\SYMSHARE\SPBBC\UPDMGR.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\SEVINST\SEVINST.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\NAVTOOLS\REPAIR\WELCHIA\FIXWELCH.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\NAVTOOLS\REPAIR\SASSER\FXSASSER.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\NAVTOOLS\REPAIR\NETSKY\FXNETSKY.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\NAVTOOLS\REPAIR\MYDOOM\FXMYDOOM.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\NAVTOOLS\REPAIR\GAOBOTUJ\FXGAOUJ.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\NAVTOOLS\REPAIR\GAOBOT\FXGAOBOT.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\NAVTOOLS\REPAIR\BLASTER\FIXBLAST.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\MSI\INSTMSIA.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\MSI\INSTMSIW.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\LUPDATE\LUSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\LIVEREG\ADVISOR.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\LIVEREG\IRALRSHL.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\LIVEREG\SYMCSUB.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\LIVEREG\VCCLNUP.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\LIVEREG\VCSETUP.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\EDISK\NED.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\CCCOMMON\CCCOMMON\CCAPP.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\CCCOMMON\CCCOMMON\CCEVTMGR.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\CCCOMMON\CCCOMMON\CCLGVIEW.EXE  
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\CCCOMMON\CCCOMMON\CCPWDSVC.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\CCCOMMON\CCCOMMON\CCSETMGR.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\SUPPORT\CCCOMMON\CCCOMMON\NMAIN.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\OMIGRATE.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\IWP\APP\ALEUPDAT.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\IWP\APP\NPFMNTOR.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\BOOTWARN.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\CFGWIZ.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\LRSEND.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\CCIMSCN.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\NAVAPSVC.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\NAVSTUB.EXE


----------



## luisa (Aug 29, 2005)

Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\NAVW32.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\NAVWNT.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\OPSCAN.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\QCONSOLE.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\NORTON\APP\SAVSCAN.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\NAV\EXTERNAL\COMMONFI\SYMSHARE\SMNLNCH.EXE 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\KEYGEN\KeyGen.exe 
Virus:W32/Parite.B Disinfected C:\Downloads\Norton AntiVirus 2005 With KeyGen\KEYGEN\NAV-TMG.KeyGen.exe 
Virus:W32/Parite.B Disinfected C:\Downloads\ccsetup122.exe 
Virus:W32/Parite.B Disinfected C:\unzipped\startdreck217[1]\StartDreck.exe 
Virus:W32/Parite.B Disinfected C:\unzipped\startdreck217\StartDreck.exe 
Virus:W32/Parite.B Disinfected C:\unzipped\everestcorporate220\everest.exe 
Virus:W32/Parite.B Disinfected C:\unzipped\WallpaperSS\WallpaperSS.exe 
Virus:W32/Parite.B Disinfected C:\holi10710807.exe 
Dialerialer.B No disinfected C:\!Submit\p2esocks_1045.dll 
Virus:W32/Parite.B Disinfected C:\!Submit\SAcc.exe


----------



## Cheeseball81 (Mar 3, 2004)

Wow. I left instructions above.


----------



## luisa (Aug 29, 2005)

Logfile of HijackThis v1.99.1
Scan saved at 8:55:08 PM, on 15/11/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\CARPSERV.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.03.0000.1005\EN-AU\MSNAPPAU.EXE
C:\PROGRAM FILES\HIJACKTHIS1991.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.planetprepaid.com.au
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.au/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\EN-AU\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.03.0000.1005\EN-XU\STMAIN.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\EN-AU\MSNTB.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - User Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - User Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab
O16 - DPF: DigiChat Applet - http://host4.digichat.com/DigiChat/DigiClasses/Client_IE.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


----------



## Cheeseball81 (Mar 3, 2004)

Since you had a smitfraud remnant, please do this too:

* *Click here* to download *smitRem.exe*. 
Save the file to your desktop. 
It is a self extracting file.
Doubleclick the smitRem.exe and it will extract the files to a smitRem folder on your desktop. 
Do not do anything with it yet. You will run the RunThis.bat file later in safe mode.

Boot into *Safe Mode*.

* Open the *smitRem* folder, then double click the *RunThis.bat* file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

Reboot, post a new log.


----------



## luisa (Aug 29, 2005)

Hi,here is my new HJT Log.
My internet seems to be running even more slow.I hope i am doing so good so far.

Logfile of HijackThis v1.99.1
Scan saved at 12:07:26 AM, on 16/11/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\CARPSERV.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\HIJACKTHIS1991.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.planetprepaid.com.au
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.au/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\EN-AU\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.03.0000.1005\EN-XU\STMAIN.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\EN-AU\MSNTB.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - User Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - User Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab
O16 - DPF: DigiChat Applet - http://host4.digichat.com/DigiChat/DigiClasses/Client_IE.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


----------



## Cheeseball81 (Mar 3, 2004)

Log appears to be clean


----------

