Jump to content


Photo

help! I won't leave me alone


  • Please log in to reply
1 reply to this topic

#1 kristinfirkins

kristinfirkins

    Member

  • New Member
  • Pip
  • 1 posts

Posted 07 July 2004 - 06:32 PM

Logfile of HijackThis v1.98.0
Scan saved at 6:27:14 PM, on 7/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\mfcmw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\services\msxmidi.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\SYSTEM32\runsvc32.exe
C:\WINDOWS\System32\zgmhsi.exe
C:\WINDOWS\sdkjd32.exe
C:\Program Files\WindowsSA\omniscient.exe
C:\documents and settings\chris\local settings\temp\FqLKRRxy.exe
C:\WINDOWS\System32\IEHost.exe
C:\Program Files\Common Files\Dpi\dpi.exe
C:\WINDOWS\Plaxo\1.5.2.32\InstallStub.exe
C:\WINDOWS\SYSTEM32\runsvc32.exe
C:\Documents and Settings\chris\Application Data\urpo.exe
C:\WINDOWS\System32\gwyqgfjt.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\antispyware\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.jetsearch.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.jetsearch.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jetsearch.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jetsearch.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.jetsearch.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.jetsearch.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jetsearch.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jetsearch.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Insight Broadband
F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,
O2 - BHO: (no name) - {2DE12247-2D24-78A2-E913-41DA46EF0E5D} - C:\WINDOWS\system32\mfcoy.dll
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=071604 serial=dr12wex-1403066-vvf lang=EN
O4 - HKLM\..\Run: [EPSON Stylus Pro 9600] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P21 "EPSON Stylus Pro 9600" /O6 "USB001" /M "Stylus Pro 9600"
O4 - HKLM\..\Run: [SAClient] "C:\Program Files\Insight\BBClient\Programs\RegCon.exe" /admincheck
O4 - HKLM\..\Run: [mffogmfo] C:\WINDOWS\System32\zgmhsi.exe
O4 - HKLM\..\Run: [winupd] C:\WINDOWS\System32\winupd.exe
O4 - HKLM\..\Run: [sdkjd32.exe] C:\WINDOWS\sdkjd32.exe
O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe
O4 - HKLM\..\Run: [FqLKRRxy] C:\documents and settings\chris\local settings\temp\FqLKRRxy.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\VbhrYQop.exe
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 - HKLM\..\Run: [AutoLoader2wrN1ackOYLP] "C:\WINDOWS\System32\propsapi.exe"
O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [238j3mh] propsapi.exe
O4 - HKLM\..\Run: [xpsystem] C:\WINDOWS\System32\services\msxmidi.exe
O4 - HKLM\..\Run: [runsvc32.exe] C:\WINDOWS\SYSTEM32\runsvc32.exe
O4 - HKLM\..\RunOnce: [mfcmw.exe] C:\WINDOWS\mfcmw.exe
O4 - HKLM\..\RunOnce: [winti32.exe] C:\WINDOWS\winti32.exe
O4 - HKLM\..\RunOnce: [crzl32.exe] C:\WINDOWS\system32\crzl32.exe
O4 - HKLM\..\RunOnce: [atlwe.exe] C:\WINDOWS\system32\atlwe.exe
O4 - HKLM\..\RunOnce: [ntqe32.exe] C:\WINDOWS\ntqe32.exe
O4 - HKLM\..\RunOnce: [mfcqn32.exe] C:\WINDOWS\mfcqn32.exe
O4 - HKLM\..\RunOnce: [sdkdy.exe] C:\WINDOWS\sdkdy.exe
O4 - HKLM\..\RunOnce: [ipxy.exe] C:\WINDOWS\ipxy.exe
O4 - HKLM\..\RunOnce: [winez32.exe] C:\WINDOWS\winez32.exe
O4 - HKLM\..\RunOnce: [msdb32.exe] C:\WINDOWS\system32\msdb32.exe
O4 - HKLM\..\RunOnce: [crss.exe] C:\WINDOWS\system32\crss.exe
O4 - HKLM\..\RunOnce: [ieia32.exe] C:\WINDOWS\ieia32.exe
O4 - HKLM\..\RunOnce: [cryh32.exe] C:\WINDOWS\cryh32.exe
O4 - HKLM\..\RunOnce: [netbz.exe] C:\WINDOWS\system32\netbz.exe
O4 - HKLM\..\RunOnce: [sdkau32.exe] C:\WINDOWS\system32\sdkau32.exe
O4 - HKLM\..\RunOnce: [crvs.exe] C:\WINDOWS\crvs.exe
O4 - HKLM\..\RunOnce: [addcm.exe] C:\WINDOWS\system32\addcm.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [PlaxoUpdate] C:\WINDOWS\Plaxo\1.5.2.32\InstallStub.exe -a
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\chris\Application Data\urpo.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - DefaultPrefix:
O13 - WWW Prefix:
O14 - IERESET.INF: START_PAGE_URL=http://www.insightbb.com
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.co...ease/instub.cab
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\windows\win.exe
O16 - DPF: {CDCC6BE5-720B-488D-A953-047E0598D996} (UpMan Class) - https://www.plaxo.co...upldr-2k-xp.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft...nloads/outc.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg...ntrol_v1-32.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} (EPlugin Control) - http://66.230.146.53/EPlugin_US.cab
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll

#2 Autodad

Autodad

    Forum Deity

  • Trusted Advisor
  • PipPipPipPipPip
  • 2,118 posts

Posted 08 July 2004 - 09:45 PM

Hello kristinfirkins,

You have a few infections, so this may take a few steps.

You have a peper infection.
First download the PeperFix.exe, a tool made by Option^Explicit, from here:
http://downloads.sub...rg/PeperFix.exe

Click on the PeperFix.exe to launch it.
Click the Find and Fix button.
You will be prompted to reboot.

Reboot and it will delete the files.
_______

After that, there appears to be some CoolWeb infection. Please download the latest version of CWShredder here
http://www.spywarein.../CWShredder.exe or here: http://www.zerosreal.../CWShredder.zip
Run it, then click "Fix" (not Scan only) and let it fix all the variants it finds.

Then Reboot.
_______

Please download a Free Trial of Trojan Hunter and run it.
Next, take a free Online Virus scan at House call and eTrust.
_______

Now, set Windows to show Hidden Files:

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
_______

Next, go to Task Manager (Ctrl + Alt + Delete) and click on "Processes" then "End Process" for all entries of these:

runsvc32.exe
urpo.exe


Then Close Task Manager.
_______

Then, open Hijackthis, click Scan, then put a check next to the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.jetsearch.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.jetsearch.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jetsearch.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jetsearch.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.jetsearch.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.jetsearch.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jetsearch.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jetsearch.org

F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe

O2 - BHO: (no name) - {2DE12247-2D24-78A2-E913-41DA46EF0E5D} - C:\WINDOWS\system32\mfcoy.dll
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

O4 - HKLM\..\Run: [mffogmfo] C:\WINDOWS\System32\zgmhsi.exe
O4 - HKLM\..\Run: [winupd] C:\WINDOWS\System32\winupd.exe
O4 - HKLM\..\Run: [sdkjd32.exe] C:\WINDOWS\sdkjd32.exe
O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe
O4 - HKLM\..\Run: [FqLKRRxy] C:\documents and settings\chris\local settings\temp\FqLKRRxy.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\VbhrYQop.exe
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 - HKLM\..\Run: [AutoLoader2wrN1ackOYLP] "C:\WINDOWS\System32\propsapi.exe"
O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [238j3mh] propsapi.exe
O4 - HKLM\..\Run: [xpsystem] C:\WINDOWS\System32\services\msxmidi.exe
O4 - HKLM\..\Run: [runsvc32.exe] C:\WINDOWS\SYSTEM32\runsvc32.exe
O4 - HKLM\..\RunOnce: [mfcmw.exe] C:\WINDOWS\mfcmw.exe
O4 - HKLM\..\RunOnce: [winti32.exe] C:\WINDOWS\winti32.exe
O4 - HKLM\..\RunOnce: [crzl32.exe] C:\WINDOWS\system32\crzl32.exe
O4 - HKLM\..\RunOnce: [atlwe.exe] C:\WINDOWS\system32\atlwe.exe
O4 - HKLM\..\RunOnce: [ntqe32.exe] C:\WINDOWS\ntqe32.exe
O4 - HKLM\..\RunOnce: [mfcqn32.exe] C:\WINDOWS\mfcqn32.exe
O4 - HKLM\..\RunOnce: [sdkdy.exe] C:\WINDOWS\sdkdy.exe
O4 - HKLM\..\RunOnce: [ipxy.exe] C:\WINDOWS\ipxy.exe
O4 - HKLM\..\RunOnce: [winez32.exe] C:\WINDOWS\winez32.exe
O4 - HKLM\..\RunOnce: [msdb32.exe] C:\WINDOWS\system32\msdb32.exe
O4 - HKLM\..\RunOnce: [crss.exe] C:\WINDOWS\system32\crss.exe
O4 - HKLM\..\RunOnce: [ieia32.exe] C:\WINDOWS\ieia32.exe
O4 - HKLM\..\RunOnce: [cryh32.exe] C:\WINDOWS\cryh32.exe
O4 - HKLM\..\RunOnce: [netbz.exe] C:\WINDOWS\system32\netbz.exe
O4 - HKLM\..\RunOnce: [sdkau32.exe] C:\WINDOWS\system32\sdkau32.exe
O4 - HKLM\..\RunOnce: [crvs.exe] C:\WINDOWS\crvs.exe
O4 - HKLM\..\RunOnce: [addcm.exe] C:\WINDOWS\system32\addcm.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\WINDOWS\Plaxo\1.5.2.32\InstallStub.exe -a
O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\chris\Application Data\urpo.exe

O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe

O13 - DefaultPrefix:
O13 - WWW Prefix:

O14 - IERESET.INF: START_PAGE_URL=http://www.insightbb.com

O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\windows\win.exe
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} (EPlugin Control) - http://66.230.146.53/EPlugin_US.cab


Now, Close all open Windows and Browsers (have only HJT open) and click "Fix Checked".


Then, Reboot to Safe Mode (tap F8 while restarting) and delete these Folders:

C:\Program Files\WindowsSA\
C:\Program Files\VVSN\
C:\Program Files\Common Files\Dpi\
C:\Program Files\AutoUpdate\

And these files:

C:\WINDOWS\mfcmw.exe
C:\WINDOWS\winti32.exe
C:\WINDOWS\ntqe32.exe
C:\WINDOWS\mfcqn32.exe
C:\WINDOWS\sdkdy.exe
C:\WINDOWS\ipxy.exe
C:\WINDOWS\winez32.exe
C:\WINDOWS\sdkjd32.exe
C:\WINDOWS\ieia32.exe
C:\WINDOWS\cryh32.exe
C:\WINDOWS\crvs.exe
C:\WINDOWS\Plaxo\1.5.2.32\InstallStub.exe -a
C:\WINDOWS\System32\propsapi.exe
C:\WINDOWS\System32\services\msxmidi.exe
C:\WINDOWS\SYSTEM32\runsvc32.exe
C:\WINDOWS\system32\crzl32.exe
C:\WINDOWS\system32\atlwe.exe
C:\WINDOWS\system32\msdb32.exe
C:\WINDOWS\system32\crss.exe
C:\WINDOWS\system32\addcm.exe
C:\WINDOWS\system32\sdkau32.exe
C:\WINDOWS\system32\netbz.exe
C:\Windows\System32\wsaupdater.exe
C:\WINDOWS\System32\zgmhsi.exe
C:\WINDOWS\System32\winupd.exe
C:\Documents and Settings\chris\Application Data\urpo.exe

Then browse to the C:\documents and settings\<Your Profile> (repeat for all users)\local settings\temp folder and delete all files and folders in it.
Then browse to the C:\Windows\Temp folder and delete all files in it.
This will delete all your cached internet content including cookies

Then in internet explorer click tools>internet Options>General. Click on Delete Files make sure you get all offline content as well.

Then, while still in Safe Mode, rerun CWShredder.

Now, reboot normally.

Please download Spybot: Search and Destroy from http://www.safer-net...g.org/index.php
Check for Updates first, download ALL Updates and Do a Scan.
When finished, make sure ALL RED items have been ticked, and click the "Fix Selected Problems" Button.

Next download AdAware from http://www.lavasoftu...pport/download/.
Install The Program and Run it. Make Sure You Click the "Check for Updates" Button before starting a scan.

Before you do a Scan, set up AdAware by clicking the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done, then please post a new HJT log.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button