Unusual Sounds on Laptop

**targh** · #1 24th Jan 2008, 09:57

Hi,

I am Having an issue with my computer and hoping someone might have some idea what would cause it. Occasionally I will hear animal sounds (cat purring, sheep bahing, etc) or a man laughing. I have scanned the computer with various antivirus and antispyware programs, but still can not find the cause. I was hoping someone might have some idea what might be causing it.

Thanks :)

**evilfantasy** · #2 24th Jan 2008, 10:06

Do you think it is malware related?

We can take a quick look to see.

Download and rename HijackThis (HJT)

Double-click on HJTInstall.
Click on the Install button.
It will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
Upon install, HijackThis should open for you.
- Close HijackThis and rename it.
- Go to C:\Program Files\Trend Micro\HijackThis.exe
- Right click on HijackThis.exe and select Rename.
- Type in sniper.exe and press Enter.
- Right-click on sniper.exe and select Send To > Desktop (create shortcut)
From the desktop open HiajckThis.
If using Windows Vista, be sure to Run As Administrator
Click on the Do a system scan and save a log file button
HijackThis will scan and then a log will open in notepad.
Copy and then paste the log in your post.
- Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Even though we have renamed HijackThis to sniper, we will still refer to it as HijackThis or HJT.

Please post the HJT log in the next reply.

**mrdaveyk** · #3 24th Jan 2008, 10:14

fair do's that made me laugh at the thought

(id love my computer to bah)

just to confirm theses aren't originating outside right?

have you checked what process' are occurring when it happens

is there any software running when it does it

ad's on a website perhaps?

**Hybr!d** · #4 24th Jan 2008, 10:15

I moved this as there is malware that does this...

**targh** · #5 24th Jan 2008, 10:17

Firefox, MSN IM, Googletalk, AIM, and YIM I usually have running all the time.

**targh** · #6 24th Jan 2008, 10:37

Ok, just hope my housemate didn't download something shouldn't of lol

Here's the log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:30:19 PM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AdwareAlert\AdwareAlertSrv.srv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AdwareAlert\AdwareAlert.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://cm.my.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\sw g.dll
O2 - BHO: (no name) - {DB35C569-5624-4CFC-8043-E5139F55A073} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [OpenGLv32] C:\Program Files\Internet Explorer\PLUGINS\cxsrrs.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://shop.ebrary.com/support/plugins/ebraryRdr.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1168008961000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1183542882812
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdwareAlert Scanning Engine (AdwareAlertSrv) - Unknown owner - C:\Program Files\AdwareAlert\AdwareAlertSrv.srv.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 9405 bytes

**evilfantasy** · #7 24th Jan 2008, 10:44

Is AdwareAlert a paid version? If not then go to add/remove programs and uninstall it.

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {DB35C569-5624-4CFC-8043-E5139F55A073} - (no file)

Close all windows except for HijackThis and click Fix checked.

Exit Hijackthis.

----------

Your Java is out of date leaving your system vulnerable.
Older versions of Java have vulnerabilities that malware can use to infect your system.

Step 1

Go to http://java.sun.com/javase/downloads/index.jsp
On the Sun Java page scroll to the 4th download.

Click the

button and save the installer to the desktop.
Double click the installer from the Desktop and follow the prompts to complete the installation.

Step 2

Go to Start > Control Panel > Add/Remove programs
Uninstall all older versions of Java.
Remove any item with Java Runtime Environment (JRE or J2SE) in the name.Do not remove Java 6 Update 4
Restart your computer once all Java components are removed.
Double click My Computer on the desktop, Locate this folder: C:\Program Files\Java
Open the Java folder and delete any subfolders except the jre1.6.0_04 folder which was just created by the newest Java installation.

----------

Then run a new HJT scan and post the log.

**targh** · #8 24th Jan 2008, 10:49

Yes, Adware Alert is paid Version, do I still need to remove it?

**evilfantasy** · #9 24th Jan 2008, 10:58

No you don't have to, it just isn't one of my favorites.

Go ahead and do the other steps and then the next two described below.

Go to this post and do steps Two and Three. Then post the log from SAS and a new a HJT log.

**targh** · #10 24th Jan 2008, 14:47

Ok here is the HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:43:41 PM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AdwareAlert\AdwareAlertSrv.srv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AdwareAlert\AdwareAlert.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\sw g.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [OpenGLv32] C:\Program Files\Internet Explorer\PLUGINS\cxsrrs.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://shop.ebrary.com/support/plugins/ebraryRdr.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1168008961000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1183542882812
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdwareAlert Scanning Engine (AdwareAlertSrv) - Unknown owner - C:\Program Files\AdwareAlert\AdwareAlertSrv.srv.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 9366 bytes

and the SAS Log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/24/2008 at 04:21 PM

Application Version : 3.9.1008

Core Rules Database Version : 3387
Trace Rules Database Version: 1381

Scan type : Complete Scan
Total Scan Time : 02:02:14

Memory items scanned : 543
Memory threats detected : 0
Registry items scanned : 7022
Registry threats detected : 18
File items scanned : 91621
File threats detected : 179

Adware.Tracking Cookie
C:\Documents and Settings\Amber\Cookies\amber@atwola[1].txt
C:\Documents and Settings\Amber\Cookies\amber@interclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@www.burstnet[2].txt
C:\Documents and Settings\Amber\Cookies\amber@eztracks.aavalue[2].txt
C:\Documents and Settings\Amber\Cookies\amber@ar.atwola[2].txt
C:\Documents and Settings\Amber\Cookies\amber@precisionclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@apmebf[1].txt
C:\Documents and Settings\Amber\Cookies\amber@stats.sellmosoft[1].txt
C:\Documents and Settings\Amber\Cookies\amber@maxserving[1].txt
C:\Documents and Settings\Amber\Cookies\amber@ehg-pcsecurityshield.hitbox[1].txt
C:\Documents and Settings\Amber\Cookies\amber@adopt.euroclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@bs.serving-sys[2].txt
C:\Documents and Settings\Amber\Cookies\amber@www.incentaclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@casalemedia[1].txt
C:\Documents and Settings\Amber\Cookies\amber@advertising[2].txt
C:\Documents and Settings\Amber\Cookies\amber@tremor.adbureau[2].txt
C:\Documents and Settings\Amber\Cookies\amber@doubleclick[2].txt
C:\Documents and Settings\Amber\Cookies\amber@screensaversandwallpa persfree[1].txt
C:\Documents and Settings\Amber\Cookies\amber@statse.webtrendslive[2].txt
C:\Documents and Settings\Amber\Cookies\amber@microsoftwlsearchcrm. 112.2o7[1].txt
C:\Documents and Settings\Amber\Cookies\amber@media.adrevolver[1].txt
C:\Documents and Settings\Amber\Cookies\amber@valueclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@csi.valueclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@adinterax[2].txt
C:\Documents and Settings\Amber\Cookies\amber@mediaplex[2].txt
C:\Documents and Settings\Amber\Cookies\amber@ad2.adnetinteractive[2].txt
C:\Documents and Settings\Amber\Cookies\amber@hitbox[2].txt
C:\Documents and Settings\Amber\Cookies\amber@server2.bkvtrack[1].txt
C:\Documents and Settings\Amber\Cookies\amber@msnlivefavorites.112. 2o7[1].txt
C:\Documents and Settings\Amber\Cookies\amber@adopt.specificclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@atdmt[2].txt
C:\Documents and Settings\Amber\Cookies\amber@directtrack[1].txt
C:\Documents and Settings\Amber\Cookies\amber@adlegend[2].txt
C:\Documents and Settings\Amber\Cookies\amber@fastclick[2].txt
C:\Documents and Settings\Amber\Cookies\amber@imrworldwide[2].txt
C:\Documents and Settings\Amber\Cookies\amber@i.screensavers[2].txt
C:\Documents and Settings\Amber\Cookies\amber@pub.visicommedia[2].txt
C:\Documents and Settings\Amber\Cookies\amber@angleinteractive.dire cttrack[2].txt
C:\Documents and Settings\Amber\Cookies\amber@adtech[1].txt
C:\Documents and Settings\Amber\Cookies\amber@ads.vlaze[1].txt
C:\Documents and Settings\Amber\Cookies\amber@tribalfusion[1].txt
C:\Documents and Settings\Amber\Cookies\amber@ads.glispa[2].txt
C:\Documents and Settings\Amber\Cookies\amber@ads.diet[1].txt
C:\Documents and Settings\Amber\Cookies\amber@ad.zanox[1].txt
C:\Documents and Settings\Amber\Cookies\amber@richmedia.yahoo[1].txt
C:\Documents and Settings\Amber\Cookies\amber@media.adrevolver[2].txt
C:\Documents and Settings\Amber\Cookies\amber@perf.overture[1].txt
C:\Documents and Settings\Amber\Cookies\amber@ad.yieldmanager[1].txt
C:\Documents and Settings\Amber\Cookies\amber@thumbplay.112.2o7[1].txt
C:\Documents and Settings\Amber\Cookies\amber@microsoftwlmessengerm kt.112.2o7[1].txt
C:\Documents and Settings\Amber\Cookies\amber@mywebsearch[2].txt
C:\Documents and Settings\Amber\Cookies\amber@redorbit[1].txt
C:\Documents and Settings\Amber\Cookies\amber@eas.apm.emediate[2].txt
C:\Documents and Settings\Amber\Cookies\amber@roiservice[1].txt
C:\Documents and Settings\Amber\Cookies\amber@xiti[1].txt
C:\Documents and Settings\Amber\Cookies\amber@ads.bridgetrack[1].txt
C:\Documents and Settings\Amber\Cookies\amber@questionmarket[2].txt
C:\Documents and Settings\Amber\Cookies\amber@collective-media[1].txt
C:\Documents and Settings\Amber\Cookies\amber@login.tracking101[2].txt
C:\Documents and Settings\Amber\Cookies\amber@burstnet[1].txt
C:\Documents and Settings\Amber\Cookies\amber@microsoftwlmailmkt.11 2.2o7[1].txt
C:\Documents and Settings\Amber\Cookies\amber@cpvfeed[1].txt
C:\Documents and Settings\Amber\Cookies\amber@zedo[1].txt
C:\Documents and Settings\Amber\Cookies\amber@ads.pointroll[1].txt
C:\Documents and Settings\Amber\Cookies\amber@specificclick[2].txt
C:\Documents and Settings\Amber\Cookies\amber@revsci[2].txt
C:\Documents and Settings\Amber\Cookies\amber@serving-sys[1].txt
C:\Documents and Settings\Amber\Cookies\amber@microsoftoffice.112.2 o7[1].txt
C:\Documents and Settings\Amber\Cookies\amber@incentaclick[1].txt
C:\Documents and Settings\Amber\Cookies\amber@azjmp[1].txt
C:\Documents and Settings\Amber\Cookies\amber@adrevolver[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adver tising[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@apmeb f[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ar.at wola[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@atwol a[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@doubl eclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@edge. ru4[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@media plex[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@perf. overture[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@revsc i[2].txt

Unclassified.SpywareBot (Not A Threat)
HKU\S-1-5-21-782665702-2079865073-2220674083-1007\Software\SpywareBot
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#Inno Setup: Setup

Version
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#Inno Setup: App Path
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#InstallLocation
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#Inno Setup: Icon

Group
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#Inno Setup: User
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#Inno Setup: Selected

Tasks
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#Inno Setup:

Deselected Tasks
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#DisplayIcon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#QuietUninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#DisplayVersion
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#Publisher
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#NoModify
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#NoRepair
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\SpywareBot_is1#InstallDate
C:\Program Files\SpywareBot\DataBase.ref
C:\Program Files\SpywareBot\HOSTS Backups\2007-7-4-1183532630_hosts
C:\Program Files\SpywareBot\HOSTS Backups\2007-7-4-1183532711_hosts
C:\Program Files\SpywareBot\HOSTS Backups\2007-7-5-1183618812_hosts
C:\Program Files\SpywareBot\HOSTS Backups\2007-7-8-1183878034_hosts
C:\Program Files\SpywareBot\HOSTS Backups
C:\Program Files\SpywareBot\Launcher.exe
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_31_58.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_31_59.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_42_18.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_42_32.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_45_31.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_45_37.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_54_57.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_09_55_06.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_10_04_16.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_10_04_27.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_10_38_13.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_10_38_16.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_20_55.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_20_58.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_22_42.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_22_47.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_25_27.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_25_29.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_31_56.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_11_31_57.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_15_52_42.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_15_52_44.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_16_27_09.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_16_27_11.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_16_27_12.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_08_45.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_08_46.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_08_48.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_46_46.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_46_48.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_58_43.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_58_44.log
C:\Program Files\SpywareBot\Log\log_2007_01_08_08_58_45.log
C:\Program Files\SpywareBot\Log\log_2007_06_22_17_15_03.log
C:\Program Files\SpywareBot\Log\log_2007_06_22_17_15_07.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_10_10.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_10_17.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_28_15.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_28_18.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_33_58.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_34_01.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_35_13.log
C:\Program Files\SpywareBot\Log\log_2007_06_24_09_35_16.log
C:\Program Files\SpywareBot\Log\log_2007_06_27_09_09_37.log
C:\Program Files\SpywareBot\Log\log_2007_06_27_09_09_55.log
C:\Program Files\SpywareBot\Log\log_2007_07_01_17_33_37.log
C:\Program Files\SpywareBot\Log\log_2007_07_01_17_33_39.log
C:\Program Files\SpywareBot\Log\log_2007_07_01_17_33_45.log
C:\Program Files\SpywareBot\Log\log_2007_07_01_21_00_52.log
C:\Program Files\SpywareBot\Log\log_2007_07_01_21_01_01.log
C:\Program Files\SpywareBot\Log\log_2007_07_04_03_03_00.log
C:\Program Files\SpywareBot\Log\log_2007_07_04_03_03_01.log
C:\Program Files\SpywareBot\Log\log_2007_07_04_03_04_55.log
C:\Program Files\SpywareBot\Log\log_2007_07_04_03_04_56.log
C:\Program Files\SpywareBot\Log\log_2007_07_04_08_14_41.log
C:\Program Files\SpywareBot\Log\log_2007_07_04_08_14_45.log
C:\Program Files\SpywareBot\Log\log_2007_07_05_22_23_34.log
C:\Program Files\SpywareBot\Log\log_2007_07_05_22_23_36.log
C:\Program Files\SpywareBot\Log\log_2007_07_05_22_23_43.log
C:\Program Files\SpywareBot\Log\log_2007_07_08_03_00_08.log
C:\Program Files\SpywareBot\Log\log_2007_07_08_08_22_16.log
C:\Program Files\SpywareBot\Log\log_2007_07_08_08_23_22.log
C:\Program Files\SpywareBot\Log\log_2007_07_08_20_53_23.log
C:\Program Files\SpywareBot\Log\log_2007_07_08_20_53_27.log
C:\Program Files\SpywareBot\Log\log_2007_07_08_20_54_28.log
C:\Program Files\SpywareBot\Log\log_2007_07_10_22_05_05.log
C:\Program Files\SpywareBot\Log\log_2007_07_10_22_05_09.log
C:\Program Files\SpywareBot\Log\log_2007_07_10_22_05_24.log
C:\Program Files\SpywareBot\Log
C:\Program Files\SpywareBot\Quarantine
C:\Program Files\SpywareBot\Registry Backups
C:\Program Files\SpywareBot\Scheduler.exe
C:\Program Files\SpywareBot\Settings\CustomScan.stg
C:\Program Files\SpywareBot\Settings\IgnoreList.stg
C:\Program Files\SpywareBot\Settings\ScanInfo.stg
C:\Program Files\SpywareBot\Settings\ScanResults.stg
C:\Program Files\SpywareBot\Settings\SelectedFolders.stg
C:\Program Files\SpywareBot\Settings\Settings.stg
C:\Program Files\SpywareBot\Settings
C:\Program Files\SpywareBot\SpywareBot.dll
C:\Program Files\SpywareBot\SpywareBot.exe
C:\Program Files\SpywareBot\SpywareBot.url
C:\Program Files\SpywareBot\unins000.dat
C:\Program Files\SpywareBot\unins000.exe
C:\Program Files\SpywareBot
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot\SpywareBot on the Web.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot\SpywareBot.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot\Uninstall SpywareBot.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SpywareBot

Adware.Lop
C:\SYSTEM VOLUME

INFORMATION\_RESTORE{F02BDCB2-9AAA-42A6-9E59-C24093E0AD6C}\RP186\A0139352.EXE