16 replies to this topic

[deva]

final scan Tuesday, September 25, 2007 6:48:20 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 25/09/2007 Kaspersky Anti-Virus database records: 423055 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target Folders C:\ D:\ L:\ Scan Statistics Total number of scanned objects 60125 Number of viruses found 2 Number of infected objects 2 Number of suspicious objects 0 Duration of the scan process 01:10:48 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Rob\Application Data\Microsoft\IMJP8_1\imjp81u.dic Object is locked skipped C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\cert8.db Object is locked skipped C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\flashgot.log Object is locked skipped C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\history.dat Object is locked skipped C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\key3.db Object is locked skipped C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\parent.lock Object is locked skipped C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\search.sqlite Object is locked skipped C:\Documents and Settings\Rob\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Rob\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Application Data\Mozilla\Firefox\Profiles\ppz0w700.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Rob\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Rob\Local Settings\History\History.IE5\MSHist012007092520070926\index.dat Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Rob\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Rob\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Rob\ntuser.dat.LOG Object is locked skipped C:\Program Files\DAEMON Tools\SetupDTSB.exe Infected: not-a-virus:AdTool.Win32.WhenU.a skipped C:\Program Files\Sygate\SPF\debug.log Object is locked skipped C:\Program Files\Sygate\SPF\rawlog.log Object is locked skipped C:\Program Files\Sygate\SPF\seclog.log Object is locked skipped C:\Program Files\Sygate\SPF\syslog.log Object is locked skipped C:\Program Files\Sygate\SPF\tralog.log Object is locked skipped C:\Program Files\Winny2\Winny.exe Infected: not-a-virus:Client-P2P.Win32.Winny.2b66 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{193BD39D-120D-4AFF-875A-455ED45AD674}\RP614\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\IMJP8_1\imjp81u.dic Object is locked skipped C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd7741.sys Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_56c.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped L:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed.

[Doug]

At the very least, you have: AdTool.Win32.WhenU.a and Client-P2P.Win32.Winny.2b66 The above are not strickly malicious, but are "adware" meaning that they do send some of your browsing and personal information back to a website home related to" Save SaveNow VVSN WhenUSearch ___________ Personally, I consider these items as "risky" and would Uninstall them, along with whatever utility they came bundled with. Some folks "tolerate" their presence in exchange for being able to use the "free version" of the utility that they downloaded/installed. The utility is often Daemon Tools. However, the "riskware" could have been bundled with various of the Codecs, dvdcloning, and p2p softwares you have installed. __________ Recommendation: Go over to our Malware Removal Forum for some expert advice on cleaning up your machine. Note: you probably "will" loose the functionality of the software application that came bundled with these "riskwares". ___________ Once you have any malware situation cleaned up, please feel free to post back into this thread with any additional questions concerns that may remain. Best Regards