HELP !!!!!!!!!!!!! : winfixer popup removal

Question

I've read the forum and I've execute Highjacthis. And here after is the resulting log file . Please could you help me to remove this pop-up that is poisoning my life. Thanks.   Logfile of HijackThis v1.99.1 Scan saved at 23:37:50, on 08/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe C:\Program Files\ISTsvc\istsvc.exe C:\Program Files\SurfAccuracy\SAcc.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\sjswyln.exe C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE C:\HJT\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [TGU1AHJj] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKLM\..\Run: [BearShare] 'C:\Program Files\BearShare\BearShare.exe' /pause O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [Á³#  L'h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Á³#  K'h'þ9Óœ÷3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe O4 - HKLM\..\RunOnce: [25428_CleanIt] C:\DOCUME~1\MANHCH~1\LOCALS~1\Temp\cleaner.bat O4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_cheatx.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E9D691D4-DC7F-4612-AC64-FAD4463E8BFE}: NameServer = 193.252.19.3,193.252.19.4 O18 - Protocol: bw+0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: offline-8876480 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

ky331 · Answer

Be advised that you have many other problems as well. since you've asked specifically about WinFixer, i'm gonna focus just on that one for the moment.

In NORMAL mode, run HJT. click on DO A SYSTEM SCAN ONLY

Place a check-mark in the box in front of the line:

O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe

Click on FIX CHECKED. Close HJT. Reboot. And see if WinFixer comes back or not.

[If WinFixer is still there... i.e., if this particular O4-line still appears in your log after rebooting... then you should reboot your system into SAFE MODE (by tapping the F8-key during the boot-up process, and selecting SAFE MODE), and try this FIX again while running HJT in SAFE MODE; and then, reboot into NORMAL mode.]

When you're done, generate and post your updated/revised HJT log, REPLYing to this thread.

mcnguyen · Answer

Hi, Your advize seems fixing up Winfixer popup. I've opened I.E. for some hours and no popup appears. I've other problems : time to time I.E. freezes my computer. I must use task manager to suppress it. And some time I must electrically reboot the PC. Also I received popup with aldult wall papers pictures or with advertizing. How can I solve those problems. Hereafter is the logfile after executing your recommandations.   Logfile of HijackThis v1.99.1 Scan saved at 11:21:42, on 09/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe C:\Program Files\ISTsvc\istsvc.exe C:\WINDOWS\sjswyln.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINDOWS\system32\WISPTIS.EXE C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\HJT\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [TGU1AHJj] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [BearShare] 'C:\Program Files\BearShare\BearShare.exe' /pause O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [Á³#  L'h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Á³#  K'h'þ9Óœ÷3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe O4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_cheatx.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E9D691D4-DC7F-4612-AC64-FAD4463E8BFE}: NameServer = 193.252.19.3,193.252.19.4 O18 - Protocol: bw+0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop best regards

ky331 · Answer

Nice work. looks like we've successfully deactivated the bad WinFixer/SurfAccuracy program. i see where you wrote that you haven't seen a WinFixer popup in hours :smileyhappy:

at present, i'm "specializing" in only certain types of infections, such as WinFixer. As i initially indicated, you have several other problems that still need to be fixed. so at this point, I'm gonna try to ask someone else to step-in, to determine/analyze your additional problems that you still have. Please be advised that we're very "understaffed" at the moment, so I can't make any guarantee as to when the next helper will arrive.

Good luck.

RKinner · Answer

Download and install ccleaner.exe from http://www.ccleaner.com. Don't let
it clean anything yet.

Download the killbox:

http://www.bleepingcomputer.com/files/killbox.php

Save it to your desktop and right click on it and then Extract it to your desktop

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Use your usual login or you will have problems finding your desktop.

Run HijackThis and just do a Scan only. Check then Fix Checked the following:

O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [TGU1AHJj] C:\WINDOWS\sjswyln.exe
O4 - HKLM\..\Run: [Á³# L"h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe
O4 - HKLM\..\Run: [Á³# K"h'þ9Óœ÷3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_cheatx.cab

Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.

Run killbox. Where it says Full Path of File to Delete you need to type or copy (Hightlight and Ctrl + c)
and Paste (move to the killbox and place the cursor in the box and Ctrl + V):

C:\Program Files\ISTsvc

Select Delete on Reboot box
and deltree box then the red button.
let it reboot

Reboot into regular mode

Run another HijackThis log and post it as a reply. Let's
see how we did. Please delete the O18 lines before posting so I can see all of the log. THese are caused by a bug in Liogitech's Desktop Manager program. I'd uninstall it and remove any of the O18 lines that remain (check and Fix Checked) then if it is something you really want go back to logitech's site and download the latest version.

Ron

mcnguyen · Answer

Hi, The winfixer popup reappears again this week end.  Could you help Logfile of HijackThis v1.99.1Scan saved at 11:15:44, on 20/12/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe C:\Program Files\ISTsvc\istsvc.exe C:\WINDOWS\sjswyln.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE C:\HJT\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [TGU1AHJj] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [BearShare] 'C:\Program Files\BearShare\BearShare.exe' /pause O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [Á³#  L'h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Á³#  K'h'þ9Óœ÷3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe O4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_cheatx.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://niku-eu.webex.com/client/v_mywebex-t20/event/ieatgpc.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E9D691D4-DC7F-4612-AC64-FAD4463E8BFE}: NameServer = 193.252.19.3,193.252.19.4

mcnguyen · Answer

remaining part of the logfile (dated December 20, 2005)   O18 - Protocol: bw+0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: offline-8876480 - {64DA865C-B7CE-47C9-8B29-755734DE8848} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

mcnguyen · Answer

OK, I will do what Rkinner told me. I'm so busy, I forgot it. I apologize. And have a good vacation.

ky331 · Answer

1) i see that RKinner had replied to you, after I took care of your first winfixer problem, with good advice that you apparently never followed-through on.... [unless precisely the identical problems all recurred on your system].   it's critical that you help us, by keeping your system clean, per our directions.   2) a quick glance at your log does not show any obvious signs of winfixer.   (no vundo/virtumundo trojan, no surfaccuracy [which you had last time], no installer).   if it's really winfixer, then you have a stealth (hidden) version.   3) i am presently set for vacation, so i am not in a position to start assisting anyone at this point.   Perhaps RKinner may still be around for a few days... i'm not sure.   If you don't hear from him within the next 2 days, please start a brand-new thread, and post your log there.   hopefully, someone else who's currently working will be able to help you.   [I will no longer be monitoring this thread]

mcnguyen · Answer

Hi, here is the logafter deleting 018 lines. Could you explain : these logs represent the system errors, are they ? I must uninstall my webcam driver (logitech) and download a new version, must I? Thanks for your help. C:\Program Files\Microsoft Office\Office\WINWORD.EXEC:\HJT\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msg r7/*http://www.yahoo.com/ext/search/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msg r7/*http://www.yahoo.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Inte rnet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9- 4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo! \Companion\Installs\cpn\yt.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7- 4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 \Reader\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD- 4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD- A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB- 4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a- AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2 -892F-0090271D4F88} - C:\Program Files\Yahoo! \Companion\Installs\cpn\yt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18- 009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exeO4 - HKLM\..\Run: [TGU1AHJj] C:\WINDOWS\sjswyln.exeO4 - HKLM\..\Run: [BearShare] 'C:\Program Files\BearShare\BearShare.exe' /pauseO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [Á³#  L'h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [Á³#  K'h'þ9Óœ÷3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\sjswyln.exeO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimizedO4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32 \ctfmon.exeO4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480 \Program\LogitechDesktopMessenger.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF -AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2 -BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www- secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cabO16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_cheatx .cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www- secure.symantec.com/techsupp/asa/ctrl/SymAData.cabO16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://niku- eu.webex.com/client/v_mywebex-t20/event/ieatgpc.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{E9D691D4- DC7F-4612-AC64-FAD4463E8BFE}: NameServer = 193.252.19.3,193.252.19.4 O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32 \matlabserver.exeO23 - Service: Service Norton AntiVirus Auto- Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32 
vsvc32.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1 \SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

mcnguyen · Answer

I do follow your advice of your last mail and generate the log I sent to you. However I did this after having the winfixer popup appearing again. So I will follow your second advice and use Symantec to remove istbar. I will keep you posted.

mcnguyen

RKinner · Answer

The Logitechdesktopmanager software is installed at the same time as the drivers for your logitech equipment.

"The Desktop Manager is another program used to auto-update via the net any Logitech programs/devices you have installed on the computer. You can manually go to the Logitech site and download any updates you might need rather than let it auto-update, but you will have to remember to do this yourself rather than depend on the program to do it for you. It works the same way as the auto-update program that MS uses to update your Windows, but even MS's program can be disabled (however, with MS, you can't even get the update center to work until you enable it again).

If you want to uninstall Logitech's you can do so through the Add/Remove Program List...but if SP2 has disabled any part of it, it might not find everything it needs to uninstall itself. If that happens, you can use this program from MS to uninstall anything in the Add/Remove Programs List.

http://support.microsoft.com/default.aspx?scid=kb;en-us;290301

Windows Installer Cleanup Utility can be downloaded from the above link and it will remove installed programs that can't be uninstalled from the Add-Remove Programs List because you don't have the cd anymore or because the program itself can't locate its uninstall file info.

There is one version of this utility available for individual windows versions from W95, W98, ME, NT 4.0, 2K, XP, and Server 2003. Direct download can be reached at this link:

http://download.microsoft.com/download/e/9/d/e9d80355-7ab4-45b8-80e8-983a48d5e1bd/msicuu2.exe

"

From a post by TONI on http://reviews.cnet.com/5208-6122-0.html?forumID=44&threadID=45840&messageID=542567

The version installed originally on your PC had a major bug in it and probably doesn't work at all. If you uninstall it you can then download the latest version from logitech.

http://www.logitech.com/index.cfm?countryid=19&languageid=1&page=downloads/software&CRID=1810&contentid=6182

However, the writeup says it also delivers "news and offers" to your PC. Sounds like you will get spam from logitech and friends but I have never used it so can't say for sure.

"Logitech® Desktop Messenger (LDM) is a free service designed to deliver software support, news and information you can use. LDM ensures that you have simple, speedy, and effortless access to product upgrades, technology tips, and technology news and offers that are relevant to you. LDM delivers information right to your desktop, allowing you to take advantage of all of the advanced features of the Logitech products you own, while staying abreast of new computer-related product and service developments (Logitech and otherwise) that are applicable to your life."

Doesn't really sound like its worth having. It's also fat. 9.1 meg download.

Anyway it was just an aside to explain and possibly correct your oversize logs. Doesn't matter as far as malware removal goes.

You still have istbar so I assume you did not follow my earlier advice. Norton also has an Istbar removal program if you want to try it instead.

http://securityresponse.symantec.com/avcenter/venc/data/adware.istbar.html

Ron

RKinner · Answer

If you are still getting winfixer popups then run RootKitRevealer from SysInternals and see if it finds anything:

http://www.sysinternals.com/Utilities/RootkitRevealer.html

The presence of a file called wingenerics.dll is the sign of a winfixer rootkit.

If you do not see it what .dll, .exe or .sys files do you see?

Ron

mcnguyen · Answer

I've executed the Symantec Adware.Istbar removal tool. The resulte is : Adware.istbar has not been found on your computer'. I will execute the revealer tool asap and will tell you the result mcnguyen

RKinner · Answer

Please post a new hijackthis log too.  (and try not to lose the formatting) Ron

mcnguyen · Answer

here is the rootkitRevealer result , no wingenerics.dll:

HKLM\SYSTEM\ControlSet002\Control\MediaProperties\PrivateProperties\Midi\Ports\Mappeur MIDI Microsoft [ 18/10/2005 16:48 0 bytes Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet002\Control\MediaProperties\PrivateProperties\Midi\Ports\SynthÚ. SW table de sons GS Mic [ 18/10/2005 16:48 0 bytes Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet004\Control\MediaProperties\PrivateProperties\Midi\Ports\Mappeur MIDI Microsoft [ 18/10/2005 16:48 0 bytes Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet004\Control\MediaProperties\PrivateProperties\Midi\Ports\SynthÚ. SW table de sons GS Mic [ 18/10/2005 16:48 0 bytes Key name contains embedded nulls (*)
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\0HIVO1A7\10592_bd_DSM2_K321SW0009[1].jpg 21/12/2005 12:55 2.49 KB Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\0HIVO1A7\alert_fnd_renault[1].jpg 21/12/2005 12:55 362 bytes Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\0HIVO1A7\CA8PUF0V.bin 21/12/2005 12:46 20.33 KB Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\0HIVO1A7\pixelblanc[1].jpg 21/12/2005 12:57 7.92 KB Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\CDEF45IJ\i[1].gif 21/12/2005 12:56 68 bytes Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\CDEF45IJ\p[2].gif 21/12/2005 12:55 49 bytes Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\CDEF45IJ\pixelblanc[1].jpg 20/12/2005 15:25 7.92 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\CDEF45IJ\top-two[1].gif 21/12/2005 12:56 9.46 KB Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\FUI7O4PN\comparison_guides-two[1].gif 21/12/2005 12:56 1.07 KB Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\FUI7O4PN\pic_lien_interne[1].gif 21/12/2005 12:55 119 bytes Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\KTEFSPM7\alerte_bandeau[1].jpg 21/12/2005 12:55 24.10 KB Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\KTEFSPM7\alerte_txt_fr[1].jpg 21/12/2005 12:55 13.70 KB Hidden from Windows API.
C:\Documents and Settings\manh chau nguyen\Local Settings\Temporary Internet Files\Content.IE5\KTEFSPM7\jasmine_alexander[1].gif 21/12/2005 12:56 1.22 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023 15/12/2005 12:16 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\CATALOG.DAT 07/12/2005 10:00 2.33 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\ECBOOTIL.VXD 07/12/2005 10:00 6.74 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\ECMSVR32.DLL 07/12/2005 10:00 281.62 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\HH 07/12/2005 10:00 1.77 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVENG.EXP 07/12/2005 10:00 99.86 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVENG.SYS 07/12/2005 10:00 75.99 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVENG.VXD 07/12/2005 10:00 86.07 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVENG32.DLL 07/12/2005 10:00 121.62 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVEX15.EXP 07/12/2005 10:00 843.08 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVEX15.SYS 07/12/2005 10:00 732.84 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVEX15.VXD 07/12/2005 10:00 886.07 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NAVEX32A.DLL 07/12/2005 10:00 769.62 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\NCSACERT.TXT 07/12/2005 10:00 6.38 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\SCRAUTH.DAT 07/12/2005 10:00 94.72 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\SYMAVENG.CAT 07/12/2005 10:00 14 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\SYMAVENG.INF 07/12/2005 10:00 901 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TCDEFS.DAT 07/12/2005 10:00 39.23 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TCSCAN7.DAT 07/12/2005 10:00 810.10 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TCSCAN8.DAT 07/12/2005 10:00 226.69 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TCSCAN9.DAT 07/12/2005 10:00 450.79 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TECHNOTE.TXT 07/12/2005 10:00 875 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TINF.DAT 07/12/2005 10:00 453 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TINFIDX.DAT 07/12/2005 10:00 148 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TINFL.DAT 07/12/2005 10:00 1.91 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TSCAN1.DAT 07/12/2005 10:00 43.54 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\TSCAN1HD.DAT 07/12/2005 10:00 1.21 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\V.GRD 07/12/2005 10:00 5.39 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\V.SIG 07/12/2005 10:00 2.19 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN.INF 07/12/2005 10:00 103.75 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN1.DAT 07/12/2005 10:00 916.66 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN2.DAT 07/12/2005 10:00 547.70 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN3.DAT 07/12/2005 10:00 141.88 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN4.DAT 07/12/2005 10:00 312.58 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN5.DAT 07/12/2005 10:00 1.64 MB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN6.DAT 07/12/2005 10:00 377.61 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN7.DAT 07/12/2005 10:00 2.68 MB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN8.DAT 07/12/2005 10:00 1.38 MB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCAN9.DAT 07/12/2005 10:00 2.76 MB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\VIRSCANT.DAT 02/10/2002 11:48 32 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\vscanmsx.dat 13/12/2005 17:16 2.02 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\WHATSNEW.TXT 07/12/2005 10:00 27.77 KB Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051207.023\ZDONE.DAT 07/12/2005 10:00 224 bytes Visible in Windows API, but not in MFT or directory index.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023 21/12/2005 13:09 0 bytes Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\CATALOG.DAT 20/12/2005 10:00 2.33 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\ECBOOTIL.VXD 20/12/2005 10:00 6.74 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\ECMSVR32.DLL 20/12/2005 10:00 281.62 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\HH 20/12/2005 10:00 3.54 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVENG.EXP 20/12/2005 10:00 99.86 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVENG.SYS 20/12/2005 10:00 76.04 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVENG.VXD 20/12/2005 10:00 86.07 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVENG32.DLL 20/12/2005 10:00 121.66 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVEX15.EXP 20/12/2005 10:00 843.92 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVEX15.SYS 20/12/2005 10:00 733.35 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVEX15.VXD 20/12/2005 10:00 886.57 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NAVEX32A.DLL 20/12/2005 10:00 769.66 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\NCSACERT.TXT 20/12/2005 10:00 6.38 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\SCRAUTH.DAT 20/12/2005 10:00 94.80 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\SYMAVENG.CAT 20/12/2005 10:00 14 bytes Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\SYMAVENG.INF 20/12/2005 10:00 901 bytes Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TCDEFS.DAT 20/12/2005 10:00 39.55 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TCSCAN7.DAT 20/12/2005 10:00 819.83 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TCSCAN8.DAT 20/12/2005 10:00 230.63 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TCSCAN9.DAT 20/12/2005 10:00 462.12 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TECHNOTE.TXT 20/12/2005 10:00 875 bytes Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TINF.DAT 20/12/2005 10:00 453 bytes Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TINFIDX.DAT 20/12/2005 10:00 148 bytes Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TINFL.DAT 20/12/2005 10:00 1.91 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TSCAN1.DAT 20/12/2005 10:00 43.57 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\TSCAN1HD.DAT 20/12/2005 10:00 1.21 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\V.GRD 20/12/2005 10:00 5.39 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\V.SIG 20/12/2005 10:00 2.19 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN.INF 20/12/2005 10:00 103.75 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN1.DAT 20/12/2005 10:00 918.06 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN2.DAT 20/12/2005 10:00 547.77 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN3.DAT 20/12/2005 10:00 141.88 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN4.DAT 20/12/2005 10:00 312.58 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN5.DAT 20/12/2005 10:00 1.78 MB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN6.DAT 20/12/2005 10:00 377.64 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN7.DAT 20/12/2005 10:00 2.73 MB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN8.DAT 20/12/2005 10:00 1.39 MB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCAN9.DAT 20/12/2005 10:00 2.82 MB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\VIRSCANT.DAT 02/10/2002 12:48 32 bytes Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\vscanmsx.dat 21/12/2005 13:00 2.02 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\WHATSNEW.TXT 20/12/2005 10:00 27.77 KB Hidden from Windows API.
C:\Program Files\Fichiers communs\Symantec Shared\VirusDefs\20051220.023\ZDONE.DAT 20/12/2005 10:00 224 bytes Hidden from Windows API.

Virus & Spyware

HELP !!!!!!!!!!!!! : winfixer popup removal

Was this post helpful?