[aurora popups] - Computer Technology Forums

WE HAVE MOVED. Please see our NEW Computer Forums
Technology Forums | Technology Careers

11-8-2009: Sorry for the inconvenience. We finally upgraded to vBulletin 3 !!
See you there,
Larry



aurora popups

Go to the Tech-Forums Discussion Home Page


Posted by: sensations

keep getting popups from aurora..grrrrrrrr attached is log if someone can help id appreciate it.Logfile of HijackThis v1.99.1
Scan saved at 11:58:03 AM, on 4/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
c:\windows\system32\kwmamqc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Cody\My Documents\My Received Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://images.google.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://www.yahoo.com[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [url]http://red.clientapps.yahoo.com/customize/ie/defaults/sb/yie6/*http://www.yahoo.com/search/ie.html[/url]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int
ernet Settings,ProxyServer = 148.244.150.58:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C:\Documents and Settings\Cody\Application Data\Mozilla\Profiles\default\xiwgmf16.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Cody\Application Data\Mozilla\Profiles\default\xiwgmf16.slt\prefs.js)
O1 - Hosts: 69.50.166.11 [url]www.google.com[/url]
O1 - Hosts: 69.50.166.11 google.com
O1 - Hosts: 69.50.166.11 [url]www.google.co.uk[/url]
O1 - Hosts: 69.50.166.11 google.co.uk
O1 - Hosts: 69.50.166.11 [url]www.google.ca[/url]
O1 - Hosts: 69.50.166.11 google.ca
O1 - Hosts: 69.50.166.11 [url]www.google.es[/url]
O1 - Hosts: 69.50.166.11 google.es
O1 - Hosts: 69.50.166.11 [url]www.google.de[/url]
O1 - Hosts: 69.50.166.11 google.de
O1 - Hosts: 69.50.166.11 [url]www.google.fr[/url]
O1 - Hosts: 69.50.166.11 google.fr
O1 - Hosts: 69.50.166.11 [url]www.google.com.au[/url]
O1 - Hosts: 69.50.166.11 google.com.au
O1 - Hosts: 69.50.166.14 [url]www.yahoo.com[/url]
O1 - Hosts: 69.50.166.14 yahoo.com
O1 - Hosts: 66.218.75.184 mail.yahoo.com
O1 - Hosts: 69.50.166.12 [url]www.msn.com[/url]
O1 - Hosts: 69.50.166.12 msn.com
O1 - Hosts: 69.50.166.12 search.msn.com
O1 - Hosts: 69.50.166.12 [url]www.go.com[/url]
O1 - Hosts: 69.50.166.12 go.com
O1 - Hosts: 69.50.166.13 astalavista.com
O1 - Hosts: 69.50.166.13 [url]www.astalavista.com[/url]
O1 - Hosts: 69.50.166.13 astalavista.box.sk
O1 - Hosts: 69.50.166.13 cracks.am
O1 - Hosts: 69.50.166.13 [url]www.cracks.am[/url]
O2 - BHO: AddressBar Class - {1474CE44-8057-4AE3-8F3E-ED37C7C63D8A} - C:\WINDOWS\system32\iasad.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\rtneg.dll (file missing)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Tapi32] qkflphkbfuc.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [tfxdmk] c:\windows\system32\kwmamqc.exe
O4 - HKLM\..\RunServices: [Tapi32] qkflphkbfuc.exe
O4 - HKLM\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Cody"
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Cody"
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: SmartWhois - {FD9DE2B4-C926-4460-81C4-FC58C6F1062E} - C:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE (file missing)
O9 - Extra button: (no name) - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - C:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE (file missing)
O9 - Extra 'Tools' menuitem: SmartWhois - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - C:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - [url]http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab[/url]
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - [url]http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB[/url]
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - [url]http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab[/url]
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - [url]http://www.windowsecurity.com/trojanscan/TDECntrl.CAB[/url]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [url]http://by22fd.bay22.hotmail.msn.com/resources/MsnPUpld.cab[/url]
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - [url]http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab[/url]
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - [url]http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab[/url]
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - [url]http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab[/url]
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: ezProxy - Unknown owner - C:\Program Files\ezProxy\ezEngine.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)
O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton AntiVirus\SAVScan.exe (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe


Posted by: Lobos

Let's continue on with the fix...

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's
anything that you don't understand, ask your question(s) before proceeding with the fixes. You should [b]not[/b] have any open browsers
when you are following the procedures below.

Go to [b]My Computer->Tools/View->Folder Options->View[/b] tab and make sure that 'Show hidden files and folders' (or 'Show all files') is
enabled. Also make sure that 'Display the contents of system folders' is checked. Windows XP's search feature is a little different. When
you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that [b]Search system
folders[/b], [b]Search hidden files and folders[/b], and [b]Search subfolders[/b] are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use
or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we
think is bad to keep).
===============

Click Start > Run > and type in:

services.msc

Click OK.

In the services window find System Startup Service (SvcProc).
Right click and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. Exit the Services utility.


===============

Run [b]HiJackThis[/b] then:

1. Click "[b][i]Config...[/i][/b]"
2. Click "[b][i]Misc Tools[/i][/b]"
3. Click "[b][i]Open Process manager[/i][/b]"

-

Next, while holding down the [b]CTRL[/b] key, locate ([i]if present[/i]) and click on ([i]highlight[/i]) each of the following:

[b][color=#000000]c:\windows\system32\[/color][color=#ff0000]kwmamqc.exe[/color][/b]

Now double-check and make sure that only those item(s) above are highlighted, then click "[b][i]Kill process[/i][/b]". Now, click "[b][i]Refresh[/i][/b]", check again, and repeat this step if any remain.

===============

Now, let's open a [b]command prompt[/b] and unregister the dll(s) we're going to remove, by entering the following:

[b][color=#000099]regsvr32 /u[/color] [color=#ff0000]iasad.dll[/color][/b]

It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save on the typing.

===============

Run [b]HiJackThis[/b] and click "[b][i]Scan[/i][/b]", then check(tick) the following, if present:


[color=#9933cc][b] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://images.google.com/[/url] [/b][/color]
[color=#9933cc][b] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://www.yahoo.com[/url] [/b][/color]
[color=#9933cc][b] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [url]http://red.clientapps.yahoo.com/cus.../search/ie.html[/url] [/b][/color]

[color=#9933cc][b] O1 - Hosts: 69.50.166.11 [url]www.google.com[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 google.com [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 [url]www.google.co.uk[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 google.co.uk [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 [url]www.google.ca[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 google.ca [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 [url]www.google.es[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 google.es [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 [url]www.google.de[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 google.de [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 [url]www.google.fr[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 google.fr [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 [url]www.google.com.au[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.11 google.com.au [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.14 [url]www.yahoo.com[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.14 yahoo.com [/b][/color]
[color=#9933cc][b] O1 - Hosts: 66.218.75.184 mail.yahoo.com [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.12 [url]www.msn.com[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.12 msn.com [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.12 search.msn.com [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.12 [url]www.go.com[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.12 go.com [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.13 astalavista.com [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.13 [url]www.astalavista.com[/url] [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.13 astalavista.box.sk [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.13 cracks.am [/b][/color]
[color=#9933cc][b] O1 - Hosts: 69.50.166.13 [url]www.cracks.am[/url] [/b][/color]

[color=#9933cc][b] O2 - BHO: AddressBar Class - {1474CE44-8057-4AE3-8F3E-ED37C7C63D8A} - C:\WINDOWS\system32\iasad.dll [/b][/color]
[color=#9933cc][b] O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\rtneg.dll (file missing) [/b][/color]

[color=#9933cc][b] O4 - HKLM\..\Run: [Tapi32] qkflphkbfuc.exe [/b][/color]
[color=#9933cc][b] O4 - HKLM\..\Run: [tfxdmk] c:\windows\system32\kwmamqc.exe [/b][/color]
[color=#9933cc][b] O4 - HKLM\..\RunServices: [Tapi32] qkflphkbfuc.exe [/b][/color]
[color=#9933cc][b] O4 - Startup: PowerReg Scheduler.exe [/b][/color]

[color=#9933cc][b] O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com [/b][/color]

[color=#9933cc][b] O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - [url]http://messenger.zone.msn.com/binar...kr.cab31267.cab[/url] [/b][/color]
[color=#9933cc][b] O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - [url]http://messenger.zone.msn.com/binar...nt.cab31267.cab[/url] [/b][/color]
[color=#9933cc][b] O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [url]http://by22fd.bay22.hotmail.msn.com...es/MsnPUpld.cab[/url] [/b][/color]
[color=#9933cc][b] O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - [url]http://messenger.zone.msn.com/binar...nt.cab31267.cab[/url] [/b][/color]
[color=#9933cc][b] O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - [url]http://messenger.zone.msn.com/binar...ro.cab32846.cab[/url] [/b][/color]
[color=#9933cc][b] O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - [url]http://messenger.zone.msn.com/binar...wn.cab31267.cab[/url] [/b][/color]

[color=#9933cc][b] O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe [/b][/color]


Now, with all windows closed except [b]HiJackThis[/b], click "[b][i]Fix checked[/i][/b]".

===============

Locate and [color=#ff0000][i]delete the following item(s)[/i][/color], if present. Make sure your able to view system and hidden files/ folders:

[i]files...[/i]

[b]c:\windows\system32\[color=#ff0000]kwmamqc.exe[/color][/b]
[b]C:\WINDOWS\system32\[color=#ff0000]iasad.dll[/color][/b]
[b]c:\windows\[color=#ff0000]SvcProc.exe[/color][/b]

[i]Search for...[/i]

[b][color=#ff0000]qkflphkbfuc.exe[/color][/b]

...using "[b][i]Start | Search...[/i][/b]".

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're '[i]in use[/i]', try deleting them from "[url=http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam]Safe Mode[/url]".

===============

Post back a new log, and let me know how everything goes.

-

Lobos


Posted by: Warez Monster

Remove entries at your own risk

c:\windows\system32\kwmamqc.exe This is a unknown process.

O1 - Hosts: 69.50.166.11 [url]www.google.com[/url]

O1 - Hosts: 69.50.166.11 [url]www.google.com[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 google.com
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 [url]www.google.co.uk[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 google.co.uk
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 [url]www.google.ca[/url]
Nasty This entry should be fixed immediately! Must be fixed!
O1 - Hosts: 69.50.166.11 google.ca
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 [url]www.google.es[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 google.es
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 [url]www.google.de[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 google.de
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 [url]www.google.fr[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 google.fr
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 [url]www.google.com.au[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.11 google.com.au
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.14 [url]www.yahoo.com[/url]
Nasty This entry should be fixed immediately! Must be fixed!
O1 - Hosts: 69.50.166.14 yahoo.com
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 66.218.75.184 mail.yahoo.com
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.12 [url]www.msn.com[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.12 msn.com
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.12 search.msn.com
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.12 [url]www.go.com[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.12 go.com
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.13 astalavista.com
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.13 [url]www.astalavista.com[/url]
Nasty This entry should be fixed immediately! Must be fixed!

O1 - Hosts: 69.50.166.13 astalavista.box.sk Must be fixed!

O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\system32\rtneg.dll (file missing) Entries found in this registry zone are potentially nasty. This application ([999A06FF-10EF-4A29-8640-69E99882C26B] - Result: ) has been checked Unknown application.

O4 - HKLM\..\Run: [Tapi32] qkflphkbfuc.exe Unknown application

O4 - HKLM\..\RunServices: [Tapi32] qkflphkbfuc.exe Unknown application.

O9 - Extra button: SmartWhois - {FD9DE2B4-C926-4460-81C4-FC58C6F1062E} - C:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE (file missing) Unknown buttons or entries in the 'Extras'-menu should be fixed.

O9 - Extra button: (no name) - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - C:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE (file missing) Unknown buttons or entries in the 'Extras'-menu should be fixed.

O9 - Extra 'Tools' menuitem: SmartWhois - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - C:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE (file missing) Unknown buttons or entries in the 'Extras'-menu should be fixed.



Please Visit the Online Configurator, Email Hosting, Internet Marketing , Computer Schools , Software for Real Estate , AAOutlook , Search Engine Site