Neo
Tomk,
Have u given up on me? 
newbe17
newbe17
Spyware / Malware / Virus Removal
[Resolved] Need to get rid of Virtumonde and Win32.TDSS.rtk.
51 min read
Tomk
newbe17,
We are not done with Worknow.com so just leave it for now.
Please download ZipIt from here:
Download 1
Download 2
Then
Hosts File Corrupted
Download HostsXpert v4.3 and unzip it to your computer, somewhere where you can find it.
Now, please give me a new HijackThis log.
We are not done with Worknow.com so just leave it for now.
Please download ZipIt from here:
Download 1
Download 2
- Double-click ZipIt! to run it.
- Then copy the content of the following codebox into the textfield:
::info:: newbe17 ::bleeping:: 73 c:\program files\xveiih.exe
- Then, just click the Zip button.
- When finished, and if successful, a new file will have been created on your Desktop. You will be notified of what the file name is when the process has been completed.
Then
Hosts File Corrupted
Download HostsXpert v4.3 and unzip it to your computer, somewhere where you can find it.
- Double click on HostsXpert.exe to launch the program.
- Click on Restore MS Hosts File to restore your Hosts file to its default condition.
- Click on Make ReadOnly to secure it against further infection.
- Exit the program.
Now, please give me a new HijackThis log.
Neo
TomK,
My apologies for the second thread 
Like you said, I was getting inpatient. I downloaded the zip it program and attempted to run it and this happened… A box appeared that said: To run this application, you must first obtain the following version of .NET Framework: v2.0.50727 Contact your application publisher for instructions about obtaining the appropriate version. Here I sit…
newbe17 
Like you said, I was getting inpatient. I downloaded the zip it program and attempted to run it and this happened… A box appeared that said: To run this application, you must first obtain the following version of .NET Framework: v2.0.50727 Contact your application publisher for instructions about obtaining the appropriate version. Here I sit…
newbe17
Neo
Tomk,
who is my application publishe so I will know where to find the site to download .NET Framework?
Tomk
newbe17,
This will do the same thing, just not automatically.
Please visit this site and follow the instructions for uploading the c:\program files\xveiih.exe file.
This will do the same thing, just not automatically.
Please visit this site and follow the instructions for uploading the c:\program files\xveiih.exe file.
Neo
Tomk,
I submitted the file.
newbe17
Tomk
newbe17,
I've got it. Thank you.
Go ahead and install HostsXpert.
Please go to Kaspersky website and perform an online antivirus scan.
Then give me a HijackThis log and also let me know if things are better.
I've got it. Thank you.
Go ahead and install HostsXpert.
Please go to Kaspersky website and perform an online antivirus scan.
- Read through the requirements and privacy statement and click on Accept button.
- It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
- When the downloads have finished, click on Settings.
- Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Click on My Computer under Scan.
- Once the scan is complete, it will display the results. Click on View Scan Report.
- You will see a list of infected items there. Click on Save Report As….
- Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
- Please post this log in your next reply.
Then give me a HijackThis log and also let me know if things are better.
Neo
Tomk,
after I clicked on restore hosts file , I got an error box telling me cannot create file C:\WINDOWS\system32\DRIVERS\ETC\hosts
what to do now?
newbe17
what to do now?
newbe17
Tomk
newbe17,
Let's do it different then.
Disable resident protections (Antivirus…); you'll re-enable them after the scan
Download Lop S&D < here
Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
(by the way. The file you uploaded is OK)
Let's do it different then.
Disable resident protections (Antivirus…); you'll re-enable them after the scan
Download Lop S&D < here
Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
(by the way. The file you uploaded is OK)
Neo
Tomk,
thanks, here's the log:
——————–\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Sempron™ Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Compaq_Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 090312-0] 4.8.1229 (Not Activated)
C:\ (Local Disk) - NTFS - Total:68 Go (Free:61 Go)
D:\ (Local Disk) - FAT32 - Total:6 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( Fri 03/13/2009|23:51 )
——————–\\ Listing folders in APPLIC~1
[08/08/2005|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[11/13/2005|04:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[11/13/2005|05:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund LLC
[10/30/2006|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[08/08/2005|06:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Hewlett-Packard
[08/04/2006|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Insight Software Solutions
[08/08/2005|05:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[08/08/2005|05:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[07/28/2006|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[06/16/2007|05:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Lavasoft
[07/30/2008|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[11/13/2005|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[08/08/2005|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI
[03/13/2009|01:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[06/13/2008|01:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[12/14/2006|03:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[11/13/2005|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[11/13/2005|09:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[07/29/2008|09:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Adobe
[08/08/2005|05:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Apple Computer
[10/05/2008|11:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ DivX
[01/09/2008|10:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ HPQ
[07/13/2005|11:48] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Identities
[10/01/2008|04:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ InterVideo
[08/08/2005|05:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Intuit
[06/13/2008|04:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Macromedia
[07/30/2008|12:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Malwarebytes
[07/29/2008|09:28] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Microsoft
[03/12/2009|08:57] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Mozilla
[10/02/2008|02:36] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ SampleView
[06/12/2008|09:18] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Sun
[08/08/2005|06:10] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Symantec
[12/22/2007|10:25] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Thunderbird
[08/08/2005|05:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Apple Computer
[07/13/2005|11:48] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[08/08/2005|05:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Intuit
[08/08/2005|06:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[08/08/2005|05:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ SampleView
[08/08/2005|06:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Symantec
[08/08/2005|05:08] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[08/08/2005|05:08] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks
[03/13/2009 12:21 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/04/2004 02:00 PM][-rah—–] C:\WINDOWS\tasks\desktop.ini
——————–\\ Listing Folders in C:\Program Files
[10/31/2006|12:21] C:\Program Files\ 56HP92-SL Driver
[08/08/2005|05:42] C:\Program Files\ Adobe
[09/04/2006|06:04] C:\Program Files\ Alwil Software
[12/22/2007|07:47] C:\Program Files\ backups
[09/22/2006|08:53] C:\Program Files\ BestOn
[03/05/2009|06:41] C:\Program Files\ CCleaner
[03/12/2009|01:05] C:\Program Files\ Common Files
[08/08/2005|05:30] C:\Program Files\ CONEXANT
[07/31/2008|06:04] C:\Program Files\ Easy Internet signup
[03/13/2009|09:56] C:\Program Files\ Full Tilt Poker.Net
[10/06/2008|06:48] C:\Program Files\ Google
[09/27/2008|06:09] C:\Program Files\ Hewlett-Packard
[03/13/2009|06:21] C:\Program Files\ InstallShield Installation Information
[07/30/2008|05:43] C:\Program Files\ Internet Explorer
[08/08/2005|05:41] C:\Program Files\ InterVideo
[08/08/2005|05:48] C:\Program Files\ iPod
[08/08/2005|05:48] C:\Program Files\ iTunes
[06/13/2008|05:00] C:\Program Files\ Java
[07/28/2006|08:32] C:\Program Files\ Kodak
[06/16/2007|05:11] C:\Program Files\ Lavasoft
[07/08/2007|01:36] C:\Program Files\ LimeWire
[03/13/2009|01:00] C:\Program Files\ Malwarebytes' Anti-Malware
[07/13/2005|11:48] C:\Program Files\ microsoft frontpage
[11/19/2008|05:15] C:\Program Files\ Microsoft Games
[12/20/2007|07:13] C:\Program Files\ Microsoft Picture It! PhotoPub
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Dancer LE
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Digital Media Edition
[08/08/2005|05:46] C:\Program Files\ Microsoft Visual Studio
[07/29/2008|09:34] C:\Program Files\ Microsoft Works
[12/22/2007|09:42] C:\Program Files\ Movie Maker
[03/13/2009|09:53] C:\Program Files\ Mozilla Firefox
[07/13/2005|11:48] C:\Program Files\ MSN
[08/08/2005|05:33] C:\Program Files\ MSN Encarta Standard
[07/13/2005|11:48] C:\Program Files\ MSN Gaming Zone
[12/22/2007|09:42] C:\Program Files\ NetMeeting
[11/13/2005|05:09] C:\Program Files\ Netscape
[09/27/2008|06:09] C:\Program Files\ Outlook Express
[08/08/2005|06:08] C:\Program Files\ PC-Doctor 5 for Windows
[08/08/2005|06:01] C:\Program Files\ PC-Doctor for DOS
[06/29/2007|09:07] C:\Program Files\ Qualcomm
[10/02/2008|04:49] C:\Program Files\ Quicken
[08/08/2005|05:49] C:\Program Files\ QuickTime
[08/08/2005|05:34] C:\Program Files\ Real
[09/22/2008|10:49] C:\Program Files\ Sonic
[01/29/2009|05:10] C:\Program Files\ Spybot - Search & Destroy
[03/09/2009|05:12] C:\Program Files\ Trend Micro
[06/13/2008|01:52] C:\Program Files\ UIU
[11/13/2005|02:56] C:\Program Files\ Viewpoint
[10/02/2008|04:50] C:\Program Files\ Windows Media Player
[12/22/2007|09:42] C:\Program Files\ Windows NT
[09/22/2006|08:52] C:\Program Files\ WMV9_VCM
[07/13/2005|11:49] C:\Program Files\ xerox
——————–\\ Listing Folders in C:\Program Files\Common Files
[08/08/2005|05:42] C:\Program Files\Common Files\ Adobe
[08/02/2008|01:13] C:\Program Files\Common Files\ AOL
[08/08/2005|05:48] C:\Program Files\Common Files\ InstallShield
[08/08/2005|05:19] C:\Program Files\Common Files\ Java
[07/28/2006|08:32] C:\Program Files\Common Files\ Kodak
[07/29/2008|09:35] C:\Program Files\Common Files\ Microsoft Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ MSSoap
[11/13/2005|02:57] C:\Program Files\Common Files\ Nullsoft
[08/08/2005|05:34] C:\Program Files\Common Files\ Real
[10/19/2008|04:12] C:\Program Files\Common Files\ Services
[08/08/2005|05:35] C:\Program Files\Common Files\ Sonic Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ SpeechEngines
[07/29/2008|09:34] C:\Program Files\Common Files\ System
[06/16/2007|05:09] C:\Program Files\Common Files\ Wise Installation Wizard
[08/08/2005|05:34] C:\Program Files\Common Files\ xing shared
——————–\\ Process
( 28 Processes )
… OK !
——————–\\ Searching with S_Lop
No Lop folder found !
——————–\\ Searching for Lop Files - Folders
No Lop folder found !
——————–\\ Searching within the Registry
….. OK !
——————–\\ Checking the Hosts file
Hosts file CLEAN
——————–\\ Searching for hidden files with Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-13 23:53:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0
——————–\\ Searching for other infections
No other infections found !
[F:3][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[F:1][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
[F:6][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - Fri 03/13/2009|23:53 - Option : [1]
——————–\\ Scan completed at 23:53:54
Nebe17
thanks, here's the log:
——————–\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Sempron™ Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Compaq_Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 090312-0] 4.8.1229 (Not Activated)
C:\ (Local Disk) - NTFS - Total:68 Go (Free:61 Go)
D:\ (Local Disk) - FAT32 - Total:6 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( Fri 03/13/2009|23:51 )
——————–\\ Listing folders in APPLIC~1
[08/08/2005|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[11/13/2005|04:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[11/13/2005|05:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund LLC
[10/30/2006|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[08/08/2005|06:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Hewlett-Packard
[08/04/2006|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Insight Software Solutions
[08/08/2005|05:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[08/08/2005|05:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[07/28/2006|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[06/16/2007|05:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Lavasoft
[07/30/2008|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[11/13/2005|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[08/08/2005|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI
[03/13/2009|01:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[06/13/2008|01:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[12/14/2006|03:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[11/13/2005|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[11/13/2005|09:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[07/29/2008|09:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Adobe
[08/08/2005|05:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Apple Computer
[10/05/2008|11:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ DivX
[01/09/2008|10:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ HPQ
[07/13/2005|11:48] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Identities
[10/01/2008|04:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ InterVideo
[08/08/2005|05:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Intuit
[06/13/2008|04:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Macromedia
[07/30/2008|12:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Malwarebytes
[07/29/2008|09:28] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Microsoft
[03/12/2009|08:57] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Mozilla
[10/02/2008|02:36] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ SampleView
[06/12/2008|09:18] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Sun
[08/08/2005|06:10] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Symantec
[12/22/2007|10:25] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Thunderbird
[08/08/2005|05:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Apple Computer
[07/13/2005|11:48] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[08/08/2005|05:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Intuit
[08/08/2005|06:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[08/08/2005|05:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ SampleView
[08/08/2005|06:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Symantec
[08/08/2005|05:08] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[08/08/2005|05:08] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks
[03/13/2009 12:21 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/04/2004 02:00 PM][-rah—–] C:\WINDOWS\tasks\desktop.ini
——————–\\ Listing Folders in C:\Program Files
[10/31/2006|12:21] C:\Program Files\ 56HP92-SL Driver
[08/08/2005|05:42] C:\Program Files\ Adobe
[09/04/2006|06:04] C:\Program Files\ Alwil Software
[12/22/2007|07:47] C:\Program Files\ backups
[09/22/2006|08:53] C:\Program Files\ BestOn
[03/05/2009|06:41] C:\Program Files\ CCleaner
[03/12/2009|01:05] C:\Program Files\ Common Files
[08/08/2005|05:30] C:\Program Files\ CONEXANT
[07/31/2008|06:04] C:\Program Files\ Easy Internet signup
[03/13/2009|09:56] C:\Program Files\ Full Tilt Poker.Net
[10/06/2008|06:48] C:\Program Files\ Google
[09/27/2008|06:09] C:\Program Files\ Hewlett-Packard
[03/13/2009|06:21] C:\Program Files\ InstallShield Installation Information
[07/30/2008|05:43] C:\Program Files\ Internet Explorer
[08/08/2005|05:41] C:\Program Files\ InterVideo
[08/08/2005|05:48] C:\Program Files\ iPod
[08/08/2005|05:48] C:\Program Files\ iTunes
[06/13/2008|05:00] C:\Program Files\ Java
[07/28/2006|08:32] C:\Program Files\ Kodak
[06/16/2007|05:11] C:\Program Files\ Lavasoft
[07/08/2007|01:36] C:\Program Files\ LimeWire
[03/13/2009|01:00] C:\Program Files\ Malwarebytes' Anti-Malware
[07/13/2005|11:48] C:\Program Files\ microsoft frontpage
[11/19/2008|05:15] C:\Program Files\ Microsoft Games
[12/20/2007|07:13] C:\Program Files\ Microsoft Picture It! PhotoPub
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Dancer LE
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Digital Media Edition
[08/08/2005|05:46] C:\Program Files\ Microsoft Visual Studio
[07/29/2008|09:34] C:\Program Files\ Microsoft Works
[12/22/2007|09:42] C:\Program Files\ Movie Maker
[03/13/2009|09:53] C:\Program Files\ Mozilla Firefox
[07/13/2005|11:48] C:\Program Files\ MSN
[08/08/2005|05:33] C:\Program Files\ MSN Encarta Standard
[07/13/2005|11:48] C:\Program Files\ MSN Gaming Zone
[12/22/2007|09:42] C:\Program Files\ NetMeeting
[11/13/2005|05:09] C:\Program Files\ Netscape
[09/27/2008|06:09] C:\Program Files\ Outlook Express
[08/08/2005|06:08] C:\Program Files\ PC-Doctor 5 for Windows
[08/08/2005|06:01] C:\Program Files\ PC-Doctor for DOS
[06/29/2007|09:07] C:\Program Files\ Qualcomm
[10/02/2008|04:49] C:\Program Files\ Quicken
[08/08/2005|05:49] C:\Program Files\ QuickTime
[08/08/2005|05:34] C:\Program Files\ Real
[09/22/2008|10:49] C:\Program Files\ Sonic
[01/29/2009|05:10] C:\Program Files\ Spybot - Search & Destroy
[03/09/2009|05:12] C:\Program Files\ Trend Micro
[06/13/2008|01:52] C:\Program Files\ UIU
[11/13/2005|02:56] C:\Program Files\ Viewpoint
[10/02/2008|04:50] C:\Program Files\ Windows Media Player
[12/22/2007|09:42] C:\Program Files\ Windows NT
[09/22/2006|08:52] C:\Program Files\ WMV9_VCM
[07/13/2005|11:49] C:\Program Files\ xerox
——————–\\ Listing Folders in C:\Program Files\Common Files
[08/08/2005|05:42] C:\Program Files\Common Files\ Adobe
[08/02/2008|01:13] C:\Program Files\Common Files\ AOL
[08/08/2005|05:48] C:\Program Files\Common Files\ InstallShield
[08/08/2005|05:19] C:\Program Files\Common Files\ Java
[07/28/2006|08:32] C:\Program Files\Common Files\ Kodak
[07/29/2008|09:35] C:\Program Files\Common Files\ Microsoft Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ MSSoap
[11/13/2005|02:57] C:\Program Files\Common Files\ Nullsoft
[08/08/2005|05:34] C:\Program Files\Common Files\ Real
[10/19/2008|04:12] C:\Program Files\Common Files\ Services
[08/08/2005|05:35] C:\Program Files\Common Files\ Sonic Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ SpeechEngines
[07/29/2008|09:34] C:\Program Files\Common Files\ System
[06/16/2007|05:09] C:\Program Files\Common Files\ Wise Installation Wizard
[08/08/2005|05:34] C:\Program Files\Common Files\ xing shared
——————–\\ Process
( 28 Processes )
… OK !
——————–\\ Searching with S_Lop
No Lop folder found !
——————–\\ Searching for Lop Files - Folders
No Lop folder found !
——————–\\ Searching within the Registry
….. OK !
——————–\\ Checking the Hosts file
Hosts file CLEAN
——————–\\ Searching for hidden files with Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-13 23:53:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0
——————–\\ Searching for other infections
No other infections found !
[F:3][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[F:1][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
[F:6][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - Fri 03/13/2009|23:53 - Option : [1]
——————–\\ Scan completed at 23:53:54
Nebe17
Neo
Tomk,
the Kaspersky website link did not work.
Newbe17
Tomk
newbe17,
Restart Lop S&D
This time choose Option 2 (Fix + Hosts)
Don't close the window during suppression!
Post the log which is created: (%SystemDrive%\lopR.txt)
Then go right on with the Kaspersky scan. (It will probably take a couple of hours)
Restart Lop S&D
This time choose Option 2 (Fix + Hosts)
Don't close the window during suppression!
Post the log which is created: (%SystemDrive%\lopR.txt)
Then go right on with the Kaspersky scan. (It will probably take a couple of hours)
Neo
Tomk,
the kasper link didn't work for me. here's something I know you will like to see (maybe I can get it from majorgeeks?)
——————–\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Sempron™ Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Compaq_Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 090312-0] 4.8.1229 (Not Activated)
C:\ (Local Disk) - NTFS - Total:68 Go (Free:61 Go)
D:\ (Local Disk) - FAT32 - Total:6 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( Sat 03/14/2009| 0:10 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ FIX
-
[ Hosts file ] .. Restored!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Deleted! - C:\Program Files\Viewpoint
Deleted! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
——————–\\ Listing folders in APPLIC~1
[08/08/2005|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[11/13/2005|04:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[11/13/2005|05:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund LLC
[10/30/2006|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[08/08/2005|06:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Hewlett-Packard
[08/04/2006|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Insight Software Solutions
[08/08/2005|05:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[08/08/2005|05:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[07/28/2006|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[06/16/2007|05:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Lavasoft
[07/30/2008|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[11/13/2005|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[08/08/2005|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI
[03/13/2009|01:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[06/13/2008|01:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[12/14/2006|03:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[11/13/2005|09:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[07/29/2008|09:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Adobe
[08/08/2005|05:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Apple Computer
[10/05/2008|11:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ DivX
[01/09/2008|10:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ HPQ
[07/13/2005|11:48] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Identities
[10/01/2008|04:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ InterVideo
[08/08/2005|05:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Intuit
[06/13/2008|04:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Macromedia
[07/30/2008|12:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Malwarebytes
[07/29/2008|09:28] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Microsoft
[03/12/2009|08:57] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Mozilla
[10/02/2008|02:36] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ SampleView
[06/12/2008|09:18] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Sun
[08/08/2005|06:10] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Symantec
[12/22/2007|10:25] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Thunderbird
[08/08/2005|05:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Apple Computer
[07/13/2005|11:48] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[08/08/2005|05:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Intuit
[08/08/2005|06:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[08/08/2005|05:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ SampleView
[08/08/2005|06:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Symantec
[08/08/2005|05:08] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[08/08/2005|05:08] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks
[03/13/2009 12:21 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/04/2004 02:00 PM][-rah—–] C:\WINDOWS\tasks\desktop.ini
——————–\\ Listing Folders in C:\Program Files
[10/31/2006|12:21] C:\Program Files\ 56HP92-SL Driver
[08/08/2005|05:42] C:\Program Files\ Adobe
[09/04/2006|06:04] C:\Program Files\ Alwil Software
[12/22/2007|07:47] C:\Program Files\ backups
[09/22/2006|08:53] C:\Program Files\ BestOn
[03/05/2009|06:41] C:\Program Files\ CCleaner
[03/12/2009|01:05] C:\Program Files\ Common Files
[08/08/2005|05:30] C:\Program Files\ CONEXANT
[07/31/2008|06:04] C:\Program Files\ Easy Internet signup
[03/13/2009|09:56] C:\Program Files\ Full Tilt Poker.Net
[10/06/2008|06:48] C:\Program Files\ Google
[09/27/2008|06:09] C:\Program Files\ Hewlett-Packard
[03/13/2009|06:21] C:\Program Files\ InstallShield Installation Information
[07/30/2008|05:43] C:\Program Files\ Internet Explorer
[08/08/2005|05:41] C:\Program Files\ InterVideo
[08/08/2005|05:48] C:\Program Files\ iPod
[08/08/2005|05:48] C:\Program Files\ iTunes
[06/13/2008|05:00] C:\Program Files\ Java
[07/28/2006|08:32] C:\Program Files\ Kodak
[06/16/2007|05:11] C:\Program Files\ Lavasoft
[07/08/2007|01:36] C:\Program Files\ LimeWire
[03/13/2009|01:00] C:\Program Files\ Malwarebytes' Anti-Malware
[07/13/2005|11:48] C:\Program Files\ microsoft frontpage
[11/19/2008|05:15] C:\Program Files\ Microsoft Games
[12/20/2007|07:13] C:\Program Files\ Microsoft Picture It! PhotoPub
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Dancer LE
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Digital Media Edition
[08/08/2005|05:46] C:\Program Files\ Microsoft Visual Studio
[07/29/2008|09:34] C:\Program Files\ Microsoft Works
[12/22/2007|09:42] C:\Program Files\ Movie Maker
[03/13/2009|09:53] C:\Program Files\ Mozilla Firefox
[07/13/2005|11:48] C:\Program Files\ MSN
[08/08/2005|05:33] C:\Program Files\ MSN Encarta Standard
[07/13/2005|11:48] C:\Program Files\ MSN Gaming Zone
[12/22/2007|09:42] C:\Program Files\ NetMeeting
[11/13/2005|05:09] C:\Program Files\ Netscape
[09/27/2008|06:09] C:\Program Files\ Outlook Express
[08/08/2005|06:08] C:\Program Files\ PC-Doctor 5 for Windows
[08/08/2005|06:01] C:\Program Files\ PC-Doctor for DOS
[06/29/2007|09:07] C:\Program Files\ Qualcomm
[10/02/2008|04:49] C:\Program Files\ Quicken
[08/08/2005|05:49] C:\Program Files\ QuickTime
[08/08/2005|05:34] C:\Program Files\ Real
[09/22/2008|10:49] C:\Program Files\ Sonic
[01/29/2009|05:10] C:\Program Files\ Spybot - Search & Destroy
[03/09/2009|05:12] C:\Program Files\ Trend Micro
[06/13/2008|01:52] C:\Program Files\ UIU
[10/02/2008|04:50] C:\Program Files\ Windows Media Player
[12/22/2007|09:42] C:\Program Files\ Windows NT
[09/22/2006|08:52] C:\Program Files\ WMV9_VCM
[07/13/2005|11:49] C:\Program Files\ xerox
——————–\\ Listing Folders in C:\Program Files\Common Files
[08/08/2005|05:42] C:\Program Files\Common Files\ Adobe
[08/02/2008|01:13] C:\Program Files\Common Files\ AOL
[08/08/2005|05:48] C:\Program Files\Common Files\ InstallShield
[08/08/2005|05:19] C:\Program Files\Common Files\ Java
[07/28/2006|08:32] C:\Program Files\Common Files\ Kodak
[07/29/2008|09:35] C:\Program Files\Common Files\ Microsoft Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ MSSoap
[11/13/2005|02:57] C:\Program Files\Common Files\ Nullsoft
[08/08/2005|05:34] C:\Program Files\Common Files\ Real
[10/19/2008|04:12] C:\Program Files\Common Files\ Services
[08/08/2005|05:35] C:\Program Files\Common Files\ Sonic Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ SpeechEngines
[07/29/2008|09:34] C:\Program Files\Common Files\ System
[06/16/2007|05:09] C:\Program Files\Common Files\ Wise Installation Wizard
[08/08/2005|05:34] C:\Program Files\Common Files\ xing shared
——————–\\ Process
( 27 Processes )
… OK !
——————–\\ Searching with S_Lop
No Lop folder found !
——————–\\ Searching for Lop Files - Folders
No Lop folder found !
——————–\\ Searching within the Registry
….. OK !
——————–\\ Checking the Hosts file
Hosts file CLEAN
——————–\\ Searching for hidden files with Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-14 00:12:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0
——————–\\ Searching for other infections
No other infections found !
[F:3][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[F:1][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
[F:6][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - Fri 03/13/2009|23:53 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - Sat 03/14/2009| 0:13 - Option : [2]
——————–\\ Scan completed at 0:13:35
the kasper link didn't work for me. here's something I know you will like to see (maybe I can get it from majorgeeks?)
——————–\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Sempron™ Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Compaq_Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 090312-0] 4.8.1229 (Not Activated)
C:\ (Local Disk) - NTFS - Total:68 Go (Free:61 Go)
D:\ (Local Disk) - FAT32 - Total:6 Go (Free:1 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( Sat 03/14/2009| 0:10 )
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ FIX
-
[ Hosts file ] .. Restored!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
Deleted! - C:\Program Files\Viewpoint
Deleted! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
——————–\\ Listing folders in APPLIC~1
[08/08/2005|05:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[11/13/2005|04:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[11/13/2005|05:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund LLC
[10/30/2006|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[08/08/2005|06:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Hewlett-Packard
[08/04/2006|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Insight Software Solutions
[08/08/2005|05:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[08/08/2005|05:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[07/28/2006|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[06/16/2007|05:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Lavasoft
[07/30/2008|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[11/13/2005|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks
[08/08/2005|05:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[08/08/2005|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI
[03/13/2009|01:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[06/13/2008|01:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[12/14/2006|03:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[11/13/2005|09:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[07/29/2008|09:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Adobe
[08/08/2005|05:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Apple Computer
[10/05/2008|11:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ DivX
[01/09/2008|10:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ HPQ
[07/13/2005|11:48] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Identities
[10/01/2008|04:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ InterVideo
[08/08/2005|05:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Intuit
[06/13/2008|04:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Macromedia
[07/30/2008|12:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Malwarebytes
[07/29/2008|09:28] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Microsoft
[03/12/2009|08:57] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Mozilla
[10/02/2008|02:36] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ SampleView
[06/12/2008|09:18] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Sun
[08/08/2005|06:10] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Symantec
[12/22/2007|10:25] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Thunderbird
[08/08/2005|05:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Apple Computer
[07/13/2005|11:48] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[08/08/2005|05:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Intuit
[08/08/2005|06:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[08/08/2005|05:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Real
[08/08/2005|05:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ SampleView
[08/08/2005|06:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Symantec
[08/08/2005|05:08] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[08/08/2005|05:08] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks
[03/13/2009 12:21 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/04/2004 02:00 PM][-rah—–] C:\WINDOWS\tasks\desktop.ini
——————–\\ Listing Folders in C:\Program Files
[10/31/2006|12:21] C:\Program Files\ 56HP92-SL Driver
[08/08/2005|05:42] C:\Program Files\ Adobe
[09/04/2006|06:04] C:\Program Files\ Alwil Software
[12/22/2007|07:47] C:\Program Files\ backups
[09/22/2006|08:53] C:\Program Files\ BestOn
[03/05/2009|06:41] C:\Program Files\ CCleaner
[03/12/2009|01:05] C:\Program Files\ Common Files
[08/08/2005|05:30] C:\Program Files\ CONEXANT
[07/31/2008|06:04] C:\Program Files\ Easy Internet signup
[03/13/2009|09:56] C:\Program Files\ Full Tilt Poker.Net
[10/06/2008|06:48] C:\Program Files\ Google
[09/27/2008|06:09] C:\Program Files\ Hewlett-Packard
[03/13/2009|06:21] C:\Program Files\ InstallShield Installation Information
[07/30/2008|05:43] C:\Program Files\ Internet Explorer
[08/08/2005|05:41] C:\Program Files\ InterVideo
[08/08/2005|05:48] C:\Program Files\ iPod
[08/08/2005|05:48] C:\Program Files\ iTunes
[06/13/2008|05:00] C:\Program Files\ Java
[07/28/2006|08:32] C:\Program Files\ Kodak
[06/16/2007|05:11] C:\Program Files\ Lavasoft
[07/08/2007|01:36] C:\Program Files\ LimeWire
[03/13/2009|01:00] C:\Program Files\ Malwarebytes' Anti-Malware
[07/13/2005|11:48] C:\Program Files\ microsoft frontpage
[11/19/2008|05:15] C:\Program Files\ Microsoft Games
[12/20/2007|07:13] C:\Program Files\ Microsoft Picture It! PhotoPub
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Dancer LE
[08/08/2005|05:43] C:\Program Files\ Microsoft Plus! Digital Media Edition
[08/08/2005|05:46] C:\Program Files\ Microsoft Visual Studio
[07/29/2008|09:34] C:\Program Files\ Microsoft Works
[12/22/2007|09:42] C:\Program Files\ Movie Maker
[03/13/2009|09:53] C:\Program Files\ Mozilla Firefox
[07/13/2005|11:48] C:\Program Files\ MSN
[08/08/2005|05:33] C:\Program Files\ MSN Encarta Standard
[07/13/2005|11:48] C:\Program Files\ MSN Gaming Zone
[12/22/2007|09:42] C:\Program Files\ NetMeeting
[11/13/2005|05:09] C:\Program Files\ Netscape
[09/27/2008|06:09] C:\Program Files\ Outlook Express
[08/08/2005|06:08] C:\Program Files\ PC-Doctor 5 for Windows
[08/08/2005|06:01] C:\Program Files\ PC-Doctor for DOS
[06/29/2007|09:07] C:\Program Files\ Qualcomm
[10/02/2008|04:49] C:\Program Files\ Quicken
[08/08/2005|05:49] C:\Program Files\ QuickTime
[08/08/2005|05:34] C:\Program Files\ Real
[09/22/2008|10:49] C:\Program Files\ Sonic
[01/29/2009|05:10] C:\Program Files\ Spybot - Search & Destroy
[03/09/2009|05:12] C:\Program Files\ Trend Micro
[06/13/2008|01:52] C:\Program Files\ UIU
[10/02/2008|04:50] C:\Program Files\ Windows Media Player
[12/22/2007|09:42] C:\Program Files\ Windows NT
[09/22/2006|08:52] C:\Program Files\ WMV9_VCM
[07/13/2005|11:49] C:\Program Files\ xerox
——————–\\ Listing Folders in C:\Program Files\Common Files
[08/08/2005|05:42] C:\Program Files\Common Files\ Adobe
[08/02/2008|01:13] C:\Program Files\Common Files\ AOL
[08/08/2005|05:48] C:\Program Files\Common Files\ InstallShield
[08/08/2005|05:19] C:\Program Files\Common Files\ Java
[07/28/2006|08:32] C:\Program Files\Common Files\ Kodak
[07/29/2008|09:35] C:\Program Files\Common Files\ Microsoft Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ MSSoap
[11/13/2005|02:57] C:\Program Files\Common Files\ Nullsoft
[08/08/2005|05:34] C:\Program Files\Common Files\ Real
[10/19/2008|04:12] C:\Program Files\Common Files\ Services
[08/08/2005|05:35] C:\Program Files\Common Files\ Sonic Shared
[07/13/2005|11:48] C:\Program Files\Common Files\ SpeechEngines
[07/29/2008|09:34] C:\Program Files\Common Files\ System
[06/16/2007|05:09] C:\Program Files\Common Files\ Wise Installation Wizard
[08/08/2005|05:34] C:\Program Files\Common Files\ xing shared
——————–\\ Process
( 27 Processes )
… OK !
——————–\\ Searching with S_Lop
No Lop folder found !
——————–\\ Searching for Lop Files - Folders
No Lop folder found !
——————–\\ Searching within the Registry
….. OK !
——————–\\ Checking the Hosts file
Hosts file CLEAN
——————–\\ Searching for hidden files with Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-14 00:12:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0
——————–\\ Searching for other infections
No other infections found !
[F:3][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[F:1][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
[F:6][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - Fri 03/13/2009|23:53 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - Sat 03/14/2009| 0:13 - Option : [2]
——————–\\ Scan completed at 0:13:35
Tomk
newbe17,
Kaspersky is an online scanner so you can't just download it. If it won't work, then we'll use a different one.
I need you to run the following scan: Eset Online Scanner
Kaspersky is an online scanner so you can't just download it. If it won't work, then we'll use a different one.
I need you to run the following scan: Eset Online Scanner
- Place a check mark in the box YES, I accept the Terms Of Use
- Click the Start button.
- Now click the Install button.
- Click Start. The scanner engine will initialize and update.
- Do Not place a check mark in the box beside Remove found threats.
- Click the Scan button. The scan will now run, please be patient.
- When the scan finishes click the Details tab.
- Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Neo
Tomk,
the Eset Online Scanner link didn't work either…. Does it work for you? Is it my computer, or just a bad link?
newbe17
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI