Lots Of "delete Failed" Stuff And Pop Ups

Hello less0305 , welcome to the TC.

This is what I suggest you do.

Please do all the steps in the order they are listed

Uninstall Virtumundo from control panel >> add remove program if listed there.

If it wasn't listed, skip the reboot.
Reboot

Download LSPfix here: http://www.cexx.org/lspfix.htm

Start the program and then check the I know what I'm doing box.

Move all instances of calsp.dll (and nothing else), to the Remove pane.
Click the Finish Button and reboot.

Find and delete the file c:\windows\system\calsp.dll


1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.

First, enable the viewing of Hidden Files and Folders as follows:
-At your Desktop, go to Start>My Computer
-Select the Tools menu and then Folder Options
-After the new window appears select the View tab
-Select: Display the contents of system folders
-Under the Hidden files and folders section select: Show hidden files and folders
-Remove the checkmark from Hide file extensions for known file types
-Remove the checkmark from Hide protected operating system files (Recommended)
-Press the Apply button
Click OK



NEXT

Please download Vx2 Finder and safe it to its own folder. http://downloads.subratam.org/VX2Finder(126).exe
Run VX2Finder(126).exe
Select: Click to Find VX2.Betterinternet
When the scan is done, select the Make Log
Copy the log and post it.

NEXT

Download Find_It.zip:
http://computercops.biz/zx/Zupe/Find%20It%20NT-2K-XP.zip
Unzip its contents to its own folder
Open the folder and double click on Find.bat (File with a gear symbol)
Ignore any File not found messages
It runs for a minute, and produces a log
Please copy and paste the log on your next response.

NEXT

Also, download KillBox.zip from the link below.
http://www.subratam.org/?page=removal
Place it in a folder on your Desktop.
Do not run it yet.

NEXT

Please look in your sytem32 folder and let me know if the below file is preset.

C:\Windows\system32\guard.tmp

NEXT

Post all the logs and DO NOT REBOOT or Shutdown please.

Log for VX2.BetterInternet File Finder (msg126) Files Found— Additional Files— Keys Under Notify— AtiExtEvent crypt32chain cryptnet cscdll RunOnceEx ScCertProp Schedule sclgntfy SensLogn termsrv wlballoon Guardian Key— is called: User Agent String— {D2605C38-05A4-48EA-BA07-805844EE796F}

Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/18/2004 10:01 PM 225,702 r2p80c7uef.dll 12/18/2004 06:41 PM dllcache 12/18/2004 11:42 AM 223,918 j62qlgf5162.dll 12/15/2004 09:33 PM 224,170 o4lule391h.dll 05/07/2004 10:12 AM Microsoft 3 File(s) 673,790 bytes 2 Dir(s) 52,280,287,232 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/18/2004 07:11 PM 890 vsconfig.xml 12/18/2004 06:41 PM dllcache 12/15/2004 10:53 PM 4,212 zllictbl.dat 05/07/2004 10:03 AM 488 WindowsLogon.manifest 05/07/2004 10:03 AM 488 logonui.exe.manifest 05/07/2004 10:03 AM 749 sapi.cpl.manifest 05/07/2004 10:03 AM 749 nwc.cpl.manifest 05/07/2004 10:03 AM 749 wuaucpl.cpl.manifest 05/07/2004 10:03 AM 749 cdplayer.exe.manifest 05/07/2004 10:03 AM 749 ncpa.cpl.manifest 9 File(s) 9,823 bytes 1 Dir(s) 52,280,283,136 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/18/2004 10:10 PM 224,724 guard.tmp 1 File(s) 224,724 bytes 0 Dir(s) 52,280,283,136 bytes free ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is F872-4E8F Directory of C:\WINDOWS\System32 12/18/2004 10:10 PM 224,724 guard.tmp 09/22/2004 06:46 PM 2,362,104 SET51.tmp 09/22/2004 06:46 PM 86,016 SET9A.tmp 09/22/2004 06:46 PM 229,376 SET3F.tmp 03/31/2003 04:00 AM 2,577 CONFIG.TMP 5 File(s) 2,904,797 bytes 0 Dir(s) 52,280,283,136 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{D2605C38-05A4-48EA-BA07-805844EE796F}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\j62qlgf5162.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 —————- Xfind Locked Files —————– C:\WINDOWS\System32\J62QLG~1.DLL +++ File read error ————– XFind Qoologic Results ————– C:\WINDOWS\System32\J62QLG~1.DLL +++ File read error ————– XFind Aspack Results ————— C:\WINDOWS\System32\J62QLG~1.DLL +++ File read error ————– Locate.com Results ————— C:\WINDOWS\SYSTEM32\ j62qlg~1.dll Sat Dec 18 2004 11:42:48a ..S.R 223,918 218.67 K o4lule~1.dll Wed Dec 15 2004 9:33:30p ..S.R 224,170 218.91 K r2p80c~1.dll Sat Dec 18 2004 10:01:36p ..S.R 225,702 220.41 K vsconfig.xml Sat Dec 18 2004 7:11:50p A..H. 890 0.87 K zllictbl.dat Wed Dec 15 2004 10:53:02p …H. 4,212 4.11 K 5 items found: 5 files, 0 directories. Total of file sizes: 678,892 bytes 662.98 K 

the guard.tmp file is present in C:\Windows\System32 file.

the guard.tmp file is present in C:\Windows\System32 file. Awaiting your reply. Thanks so much.

If you have not rebooted or shutdown/restarted, proceed as follows:

First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)
____
Next, launch Notepad, and copy/paste all the blue REGEDIT below to it
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{D2605C38-05A4-48EA-BA07-805844EE796F}"=-

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx]

Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information.
____
Now, extract KillBox (downloaded earlier) from the zip file and double-click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\system32\j62qlgf5162.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.

Do the same as above for each of the files that follow, and select No when asked to reboot!
C:\WINDOWS\system32\r2p80c7uef.dll
C:\WINDOWS\system32\j62qlgf5162.dll
C:\WINDOWS\system32\o4lule391h.dll
C:\WINDOWS\System32\J62QLG~1.DLL

Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\System32\guard.tmp
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Make sure all windows are closed before proceeding to run HijackThis and Scan. Fix the following by placing a check in the appropriate box and selecting Fix Checked:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvgyj32.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: VTAgentReboot.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {6632A7E9-FE1F-43D2-A04A-A15951ED63E0} - http://mediaplayer.walmart.com/installer/install.cab

O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

Reboot the computer.
____
Since this intruder may alter the Hosts file, download the Hoster to restore the file:
http://members.aol.com/toadbee/hoster.zip
Select: Restore Original Hosts
Click OK and exit Hoster.
____
Next, download AdAware SE from the following link:
http://www.majorgeeks.com/download506.html
-Use the: 'Check for Updates Now' option and download the latest reference files
-Use the Start button, and on the next window, select: Perform Full System Scan
-Please deselect: Search for negligible risk entries
When the scan completes, select: Show Logfile
Copy/paste the complete log file, which may take 2-3 consecutive posts to this topic.

Also, check the Recycle Bin to see if it works properly. A side effect of VX2 is to sometimes damage the Recycle Bin operation.
Create an blank Notepad file on the Desktop: right click the Desktop, select New>Text Document
Right click the text document and delete it.
When a file is deleted, it should ask if you want to send it to Recycle Bin.
Does it ask if you want to send the file to the Recycle Bin, or, does the file just get deleted?
Post back what it does.

When done with all of the above, close all windows and browsers, run HijackThis, Scan, post a new HijackThis log, and a new Find_It log.

If you encounter any problems with the steps above, please describe them.

LD…. I've gotten down to the Hi jack this and putting the check and fixing the items you told me to. One item will not delete: O4 - Global Startup: VTAgentReboot.exe I get a message that says the program is in use, use tasks manager to end task on the program and then run hi jack again. when i pull up my task manager, I don't see this program running. Of course, I'm looking for VTAgentReboot or anything close to that, and I don't see it in the list. What do I do next?

We'll get that one later…continue on with the rest

I'm running full scan with ad aware right nowl. I did the recycle bin thing….it came up with a message asking me if I really wanted to delete and move to the recycle bin. I clicked yes.

Ad-Aware SE Build 1.05 Logfile Created on:Saturday, December 18, 2004 8:45:05 PM Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R23 16.12.2004 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» BargainBuddy(TAC index:8):30 total references CoolWebSearch(TAC index:10):3 total references DyFuCA(TAC index:3):5 total references Ebates MoneyMaker(TAC index:4):1 total references Elitum.ElitebarBHO(TAC index:5):53 total references IBIS Toolbar(TAC index:5):9 total references Other(TAC index:5):1 total references Rads01.Quadrogram(TAC index:6):2 total references Search Miracle(TAC index:5):9 total references SecondThought(TAC index:4):8 total references Tracking Cookie(TAC index:3):45 total references Winpup32(TAC index:6):1 total references VX2(TAC index:10):7 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 12-18-2004 8:45:05 PM - Scan started. (Full System Scan) Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 504 ThreadCreationTime : 12-19-2004 4:20:57 AM BasePriority : Normal #:2 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 576 ThreadCreationTime : 12-19-2004 4:21:05 AM BasePriority : High #:3 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 620 ThreadCreationTime : 12-19-2004 4:21:08 AM BasePriority : Normal FileVersion : 5.1.2600.1152 (xpsp2.021217-1051) ProductVersion : 5.1.2600.1152 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:4 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 632 ThreadCreationTime : 12-19-2004 4:21:08 AM BasePriority : Normal FileVersion : 5.1.2600.1106 (xpsp1.020828-1920) ProductVersion : 5.1.2600.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:5 [ati2evxx.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 820 ThreadCreationTime : 12-19-2004 4:21:13 AM BasePriority : Normal #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 860 ThreadCreationTime : 12-19-2004 4:21:13 AM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 956 ThreadCreationTime : 12-19-2004 4:21:14 AM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [acs.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1096 ThreadCreationTime : 12-19-2004 4:21:14 AM BasePriority : Normal #:9 [ccsetmgr.exe] FilePath : C:\Program Files\Common Files\Symantec Shared\ ProcessID : 1428 ThreadCreationTime : 12-19-2004 4:21:20 AM BasePriority : Normal FileVersion : 2.1.3.4 ProductVersion : 2.1.3.4 ProductName : Common Client CompanyName : Symantec Corporation FileDescription : Common Client Settings Manager Service InternalName : ccSetMgr LegalCopyright : Copyright © 2000-2003 Symantec Corporation. All rights reserved. OriginalFilename : ccSetMgr.exe #:10 [ccevtmgr.exe] FilePath : C:\Program Files\Common Files\Symantec Shared\ ProcessID : 1448 ThreadCreationTime : 12-19-2004 4:21:21 AM BasePriority : Normal FileVersion : 2.1.3.4 ProductVersion : 2.1.3.4 ProductName : Common Client CompanyName : Symantec Corporation FileDescription : Common Client Event Manager Service InternalName : ccEvtMgr LegalCopyright : Copyright © 2000-2003 Symantec Corporation. All rights reserved. OriginalFilename : ccEvtMgr.exe

#:11 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1612 ThreadCreationTime : 12-19-2004 4:21:22 AM BasePriority : Normal FileVersion : 5.1.2600.0 (XPClient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:12 [acsd.exe] FilePath : C:\PROGRA~1\COMMON~1\AOL\ACS\ ProcessID : 1744 ThreadCreationTime : 12-19-2004 4:21:29 AM BasePriority : Normal #:13 [cdac11ba.exe] FilePath : C:\WINDOWS\System32\drivers\ ProcessID : 1780 ThreadCreationTime : 12-19-2004 4:21:29 AM BasePriority : Normal FileVersion : 4.11.050 ProductVersion : 4.11.050 Windows NT 2001/07/12 ProductName : SafeCast Windows NT CompanyName : C-Dilla Ltd FileDescription : C-Dilla RTS Service InternalName : CDANTSRV LegalCopyright : Copyright © Macrovision 1993-2001 OriginalFilename : CDANTSRV.EXE Comments : StringFileInfo: U.S. English #:14 [cfsvcs.exe] FilePath : C:\Program Files\TOSHIBA\ConfigFree\ ProcessID : 1800 ThreadCreationTime : 12-19-2004 4:21:29 AM BasePriority : Normal FileVersion : 4, 60, 0, 2 ProductVersion : 4, 60, 0, 0 ProductName : ConfigFree™ CompanyName : TOSHIBA CORPORATION FileDescription : Service of ConfigFree. InternalName : CFSvcs.exe LegalCopyright : Copyright © 2003 TOSHIBA CORPORATION. All rights reserved. LegalTrademarks : ConfigFree™ OriginalFilename : CFSvcs.exe Comments : Service of ConfigFree. #:15 [dvdramsv.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1828 ThreadCreationTime : 12-19-2004 4:21:30 AM BasePriority : Normal FileVersion : 2, 0, 7, 0 ProductVersion : 2, 0, 7, 0 CompanyName : Matsushita Electric Industrial Co., Ltd. FileDescription : Service of RAMAsst for Windows XP LegalCopyright : Copyright © Matsushita Electric Industrial Co., Ltd. 2002 - 2003 OriginalFilename : DVDRAMSV.EXE #:16 [navapsvc.exe] FilePath : C:\Program Files\Norton AntiVirus\ ProcessID : 1872 ThreadCreationTime : 12-19-2004 4:21:30 AM BasePriority : Normal FileVersion : 10.00.2 ProductVersion : 10.00.2 ProductName : Norton AntiVirus CompanyName : Symantec Corporation FileDescription : Norton AntiVirus Auto-Protect Service InternalName : NAVAPSVC LegalCopyright : Norton AntiVirus 2004 for Windows 98/ME/2000/XP Copyright © 2003 Symantec Corporation. All rights reserved. OriginalFilename : NAVAPSVC.EXE #:17 [savscan.exe] FilePath : C:\Program Files\Norton AntiVirus\ ProcessID : 1920 ThreadCreationTime : 12-19-2004 4:21:31 AM BasePriority : Normal FileVersion : 9.2.1.14 ProductVersion : 9.2 ProductName : Symantec AntiVirus AutoProtect CompanyName : Symantec Corporation FileDescription : Symantec AntiVirus Scanner InternalName : SAVSCAN LegalCopyright : Copyright © 2003 Symantec Corporation OriginalFilename : SAVSCAN.EXE #:18 [swupdtmr.exe] FilePath : c:\Toshiba\IVP\swupdate\ ProcessID : 132 ThreadCreationTime : 12-19-2004 4:21:34 AM BasePriority : Normal #:19 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZoneLabs\ ProcessID : 212 ThreadCreationTime : 12-19-2004 4:21:35 AM BasePriority : Normal FileVersion : 5.5.062.004 ProductVersion : 5.5.062.004 ProductName : TrueVector Service CompanyName : Zone Labs Inc. FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1998-2004, Zone Labs Inc. OriginalFilename : vsmon.exe #:20 [wanmpsvc.exe] FilePath : C:\WINDOWS\ ProcessID : 360 ThreadCreationTime : 12-19-2004 4:21:37 AM BasePriority : Normal FileVersion : 7, 0, 0, 2 ProductVersion : 7, 0, 0, 2 ProductName : America Online CompanyName : America Online, Inc. FileDescription : Wan Miniport (ATW) Service InternalName : WanMPSvc LegalCopyright : Copyright © 2001 America Online, Inc. OriginalFilename : WanMPSvc.exe #:21 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 408 ThreadCreationTime : 12-19-2004 4:23:35 AM BasePriority : Normal #:22 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1404 ThreadCreationTime : 12-19-2004 4:23:36 AM BasePriority : Normal FileVersion : 6.00.2800.1106 (xpsp1.020828-1920) ProductVersion : 6.00.2800.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:23 [tfswctrl.exe] FilePath : C:\WINDOWS\system32\dla\ ProcessID : 664 ThreadCreationTime : 12-19-2004 4:23:40 AM BasePriority : Normal FileVersion : 1.04.78j CompanyName : Sonic Solutions FileDescription : Drive Letter Access Component LegalCopyright : Copyright © 2004 Sonic Solutions #:24 [atiptaxx.exe] FilePath : C:\Program Files\ATI Technologies\ATI Control Panel\ ProcessID : 2116 ThreadCreationTime : 12-19-2004 4:23:43 AM BasePriority : Normal FileVersion : 6.14.10.5090 ProductVersion : 6.14.10.5090 ProductName : ATI Desktop Component CompanyName : ATI Technologies, Inc. FileDescription : ATI Desktop Control Panel InternalName : Atiptaxx.exe LegalCopyright : Copyright © 1998-2004 ATI Technologies Inc. OriginalFilename : Atiptaxx.exe #:25 [ltmoh.exe] FilePath : C:\Program Files\ltmoh\ ProcessID : 2200 ThreadCreationTime : 12-19-2004 4:23:45 AM BasePriority : Normal FileVersion : 1.73B ProductVersion : 1.73B ProductName : LtMoh Application CompanyName : Agere Systems FileDescription : LtMoh MFC Application InternalName : LtMoh LegalCopyright : Agere Copyright © 2001-2004 LegalTrademarks : Agere Systens OriginalFilename : LtMoh.EXE #:26 [agrsmmsg.exe] FilePath : C:\WINDOWS\ ProcessID : 2208 ThreadCreationTime : 12-19-2004 4:23:45 AM BasePriority : Normal FileVersion : 2.1.38 2.1.38 02/20/2004 15:00:27 ProductVersion : 2.1.38 2.1.38 02/20/2004 15:00:27 ProductName : Agere SoftModem Messaging Applet CompanyName : Agere Systems FileDescription : SoftModem Messaging Applet InternalName : smdmstat.exe LegalCopyright : Copyright © Agere Systems 1998-2000 OriginalFilename : smdmstat.exe #:27 [syntplpr.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 2220 ThreadCreationTime : 12-19-2004 4:23:46 AM BasePriority : Normal FileVersion : 7.9.2 22Jan04 ProductVersion : 7.9.2 22Jan04 ProductName : Progressive Touch CompanyName : Synaptics, Inc. FileDescription : TouchPad Driver Helper Application InternalName : SynTPLpr LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPLpr.exe #:28 [syntpenh.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 2232 ThreadCreationTime : 12-19-2004 4:23:46 AM BasePriority : Normal FileVersion : 7.9.2 22Jan04 ProductVersion : 7.9.2 22Jan04 ProductName : Progressive Touch CompanyName : Synaptics, Inc. FileDescription : Synaptics TouchPad Enhancements InternalName : Scrolleroo LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPEnh.exe #:29 [ndstray.exe] FilePath : C:\Program Files\TOSHIBA\ConfigFree\ ProcessID : 2248 ThreadCreationTime : 12-19-2004 4:23:46 AM BasePriority : Normal FileVersion : 4, 50, 0, 105 ProductVersion : 4, 5, 0, 0 ProductName : ConfigFree™ Tray CompanyName : TOSHIBA CORPORATION FileDescription : ConfigFree™ Tray InternalName : ndstray LegalCopyright : Copyright 2002-2003 © TOSHIBA CORPORATION. All rights reserved. OriginalFilename : NDSTray.exe #:30 [thotkey.exe] FilePath : C:\Program Files\Toshiba\Toshiba Applet\ ProcessID : 2268 ThreadCreationTime : 12-19-2004 4:23:47 AM BasePriority : Normal FileVersion : 1.00.0008 ProductVersion : 1.00.0008 ProductName : THotkey CompanyName : TOSHIBA InternalName : THotkey LegalCopyright : 2002-2004 LegalTrademarks : TOSHIBA Corporation OriginalFilename : THotkey.exe Comments : Hotkey

#:31 [tfncky.exe] FilePath : C:\Program Files\TOSHIBA\TOSHIBA Controls\ ProcessID : 2296 ThreadCreationTime : 12-19-2004 4:23:48 AM BasePriority : Normal FileVersion : 3.05.02 ProductVersion : 3.05.02 ProductName : TFncKy CompanyName : TOSHIBA Corporation FileDescription : TFncKy InternalName : TFncKy LegalCopyright : Copyright © 2001-2004 TOSHIBA Corporation. All rights reserved. OriginalFilename : TFncKy.EXE #:32 [padexe.exe] FilePath : C:\Program Files\TOSHIBA\Touch and Launch\ ProcessID : 2328 ThreadCreationTime : 12-19-2004 4:23:49 AM BasePriority : Normal FileVersion : 1, 2, 4, 0 ProductVersion : 1, 2, 4, 0 ProductName : PadTouch CompanyName : TOSHIBA FileDescription : PadTouch Main InternalName : PadExe LegalCopyright : Copyright © 2003-2004 TOSHIBA Corporation OriginalFilename : PadExe.exe #:33 [smoothview.exe] FilePath : C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\ ProcessID : 2336 ThreadCreationTime : 12-19-2004 4:23:50 AM BasePriority : Normal FileVersion : 2, 0, 0, 18 ProductVersion : 2, 0, 0, 18 ProductName : TOSHIBA Zooming Utility CompanyName : TOSHIBA Corporation FileDescription : SmoothView InternalName : SmoothView LegalCopyright : Copyright © 2003 TOSHIBA Corporation. All rights reserved. OriginalFilename : SmoothView.exe Comments : TOSHIBA Zooming Utility #:34 [ccapp.exe] FilePath : C:\Program Files\Common Files\Symantec Shared\ ProcessID : 2348 ThreadCreationTime : 12-19-2004 4:23:51 AM BasePriority : Normal FileVersion : 2.1.3.4 ProductVersion : 2.1.3.4 ProductName : Common Client CompanyName : Symantec Corporation FileDescription : Common Client User Session InternalName : ccApp LegalCopyright : Copyright © 2000-2003 Symantec Corporation. All rights reserved. OriginalFilename : ccApp.exe #:35 [wuauclt.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2356 ThreadCreationTime : 12-19-2004 4:23:51 AM BasePriority : Normal FileVersion : 5.4.3630.1106 (xpsp1.020828-1920) ProductVersion : 5.4.3630.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Update AutoUpdate Client InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wuauclt.exe #:36 [pinger.exe] FilePath : C:\toshiba\ivp\ism\ ProcessID : 2464 ThreadCreationTime : 12-19-2004 4:23:52 AM BasePriority : Normal FileVersion : 3.3 ProductVersion : 3.3 ProductName : Software Upgrades CompanyName : TOSHIBA Corporation FileDescription : TOSHIBA Pinger InternalName : PINGER LegalCopyright : © 1997-2002 TOSHIBA Corporation OriginalFilename : PINGER.EXE Comments : With TSysSMon support. #:37 [tpsbattm.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2476 ThreadCreationTime : 12-19-2004 4:23:52 AM BasePriority : Normal FileVersion : 1, 0, 2, 0 ProductVersion : 7, 0, 0, 0 ProductName : TOSHIBA Power Saver CompanyName : TOSHIBA Corporation InternalName : TPSBattM LegalCopyright : Copyright © 1998-2004 TOSHIBA Corporation OriginalFilename : TPSBattM.exe #:38 [zlclient.exe] FilePath : C:\Program Files\Zone Labs\ZoneAlarm\ ProcessID : 2556 ThreadCreationTime : 12-19-2004 4:23:55 AM BasePriority : Normal FileVersion : 5.5.062.004 ProductVersion : 5.5.062.004 ProductName : Zone Labs Client CompanyName : Zone Labs Inc. FileDescription : Zone Labs Client InternalName : zlclient LegalCopyright : Copyright © 1998-2004, Zone Labs Inc. OriginalFilename : zlclient.exe #:39 [viewmgr.exe] FilePath : C:\Program Files\Viewpoint\Viewpoint Manager\ ProcessID : 2620 ThreadCreationTime : 12-19-2004 4:23:56 AM BasePriority : Normal FileVersion : 2, 0, 0, 42 ProductVersion : 2, 0, 0, 42 ProductName : Viewpoint Manager CompanyName : Viewpoint Corporation FileDescription : ViewMgr InternalName : Viewpoint Manager LegalCopyright : Copyright © 2004 OriginalFilename : ViewMgr.exe Comments : Viewpoint Manager #:40 [ctfmon.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2628 ThreadCreationTime : 12-19-2004 4:23:56 AM BasePriority : Normal FileVersion : 5.1.2600.1106 (xpsp1.020828-1920) ProductVersion : 5.1.2600.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:41 [toscdspd.exe] FilePath : C:\Program Files\TOSHIBA\TOSCDSPD\ ProcessID : 2648 ThreadCreationTime : 12-19-2004 4:23:57 AM BasePriority : Normal #:42 [msmsgs.exe] FilePath : C:\Program Files\Messenger\ ProcessID : 2680 ThreadCreationTime : 12-19-2004 4:24:00 AM BasePriority : Normal FileVersion : 4.7.0041 ProductVersion : Version 4.7 ProductName : Messenger CompanyName : Microsoft Corporation FileDescription : Messenger InternalName : msmsgs LegalCopyright : Copyright © Microsoft Corporation 1997-2001 LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. OriginalFilename : msmsgs.exe #:43 [aim.exe] FilePath : C:\Program Files\AIM\ ProcessID : 2712 ThreadCreationTime : 12-19-2004 4:24:01 AM BasePriority : Normal FileVersion : 5.9.3690 ProductVersion : 5.9.3690 ProductName : AOL Instant Messenger CompanyName : America Online, Inc. FileDescription : AOL Instant Messenger InternalName : AIM LegalCopyright : Copyright © 1996-2004 America Online, Inc. OriginalFilename : AIM.EXE #:44 [psfree.exe] FilePath : C:\PROGRA~1\PANICW~1\POP-UP~1\ ProcessID : 2728 ThreadCreationTime : 12-19-2004 4:24:03 AM BasePriority : Normal FileVersion : 3, 1, 0, 1010 ProductVersion : 1, 0, 0, 1 ProductName : Pop-Up Stopper Free Edition CompanyName : Panicware, Inc. FileDescription : Pop-Up Stopper Free Edition InternalName : Pop-Up Stopper Free Edition LegalCopyright : Copyright © 2002-2003 OriginalFilename : PSFree.exe #:45 [ramasst.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2868 ThreadCreationTime : 12-19-2004 4:24:14 AM BasePriority : Normal FileVersion : 1, 0, 9, 0 ProductVersion : 1, 0, 9, 0 CompanyName : Matsushita Electric Industrial Co., Ltd. FileDescription : CD Burning of Windows XP disabling tool for DVD MULTI Drive LegalCopyright : Copyright © Matsushita Electric Industrial Co., Ltd. 2002 - 2003 OriginalFilename : RAMASST.EXE #:46 [notepad.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2820 ThreadCreationTime : 12-19-2004 4:27:19 AM BasePriority : Normal FileVersion : 5.1.2600.0 (xpclient.010817-1148) ProductVersion : 5.1.2600.0 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Notepad InternalName : Notepad LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : NOTEPAD.EXE #:47 [iexplore.exe] FilePath : C:\Program Files\Internet Explorer\ ProcessID : 456 ThreadCreationTime : 12-19-2004 4:35:23 AM BasePriority : Normal FileVersion : 6.00.2800.1106 (xpsp1.020828-1920) ProductVersion : 6.00.2800.1106 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Internet Explorer InternalName : iexplore LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : IEXPLORE.EXE #:48 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 1120 ThreadCreationTime : 12-19-2004 4:43:59 AM BasePriority : Normal FileVersion : 6.2.0.206 ProductVersion : VI.Second Edition ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Elitum.ElitebarBHO Object Recognized! Type : Regkey Data : Category : Data Miner Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\{825cf5bd-8862-4430-b771-0c15c5ca8def} Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\{825cf5bd-8862-4430-b771-0c15c5ca8def} Value : Elitum.ElitebarBHO Object Recognized! Type : Regkey Data : Category : Data Miner Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\{28caeff3-0f18-4036-b504-51d73bd81abc} Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_CLASSES_ROOT Object : clsid\{28caeff3-0f18-4036-b504-51d73bd81abc} Value : Elitum.ElitebarBHO Object Recognized! Type : Regkey Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : axparam Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : AccountNumber Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : uninstalled Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : _show Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : FirstTimeStarted Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : SearchIndex Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : AutoComplete Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : ac1 Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : adult.tbr Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : popupblocker Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : default.tbr Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : search.mnu Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : version Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : path Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : UpdateDate Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : guid Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : searchkeys Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : errorreport Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : excluded Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : keywords Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : city Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : state Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : country Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\elitum\elitetoolbar Value : Activated Ebates MoneyMaker Object Recognized! Type : RegValue Data : Category : Data Miner Comment : "AC" Rootkey : HKEY_USERS Object : S-1-5-21-1477989502-3745529247-2900513208-1006\software\lq Value : AC Elitum.ElitebarBHO Object Recognized! Type : RegValue Data : Category : Data Miner Comment : "{825CF5BD-8862-4430-B771-0C15C5CA8DEF}" Rootkey : HKEY_USERS Object : S-1-5-21-1477989502-3745529247-2900513208-1006\software\microsoft\internet explorer\toolbar\webbrowser Value : {825CF5BD-8862-4430-B771-0C15C5CA8DEF} Search Miracle Object Recognized! Type : RegValue Data : Category : Malware Comment : "kalvsys" Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\windows\currentversion\run Value : kalvsys Registry Scan result: