WOW, I am in some serious trouble here. Even though Im running much smoother, I still have lots of junk on here and trojans galore, so many I could have a sale lol. Heres my results from website and the hijackthis log right after....
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, June 13, 2006 11:03:27 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 14/06/2006
Kaspersky Anti-Virus database records: 188312
Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
H:\
Scan Statistics
Total number of scanned objects 119862
Number of viruses found 7
Number of infected objects 78
Number of suspicious objects 0
Duration of the scan process 02:05:22
Infected Object Name Virus Name Last Action
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
C:\Documents and Settings\Default User\My Documents\Data\all_files4.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
C:\Documents and Settings\Default User\My Documents\Data\Data\all_files4.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Default User\My Documents\Data\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
C:\Documents and Settings\Default User\My Documents\Data\Data\netspry.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Default User\My Documents\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
C:\Documents and Settings\Default User\My Documents\Data\netspry.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Family Access\My Documents\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
C:\Documents and Settings\Family Access\My Documents\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
C:\Documents and Settings\Family Access\My Documents\Data\all_files4.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Family Access\My Documents\Data\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
C:\Documents and Settings\Family Access\My Documents\Data\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
C:\Documents and Settings\Family Access\My Documents\Data\Data\all_files4.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Family Access\My Documents\Data\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
C:\Documents and Settings\Family Access\My Documents\Data\Data\netspry.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Family Access\My Documents\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
C:\Documents and Settings\Family Access\My Documents\Data\netspry.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM64.tmp/SETUP_POWERSEARCH.EXE/data0003 Infected: Trojan-Downloader.Win32.Keenval.k skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM64.tmp/SETUP_POWERSEARCH.EXE Infected: Trojan-Downloader.Win32.Keenval.k skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM64.tmp/SETUP_INCREDIFIND_ONLY.EXE/data0002 Infected: Trojan-Downloader.Win32.Keenval.k skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM64.tmp/SETUP_INCREDIFIND_ONLY.EXE/data0003 Infected: Trojan-Downloader.Win32.Keenval.j skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM64.tmp/SETUP_INCREDIFIND_ONLY.EXE Infected: Trojan-Downloader.Win32.Keenval.j skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM64.tmp ZIP: infected - 5 skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM66.tmp/SETUP_POWERSEARCH.EXE/data0003 Infected: Trojan-Downloader.Win32.Keenval.k skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM66.tmp/SETUP_POWERSEARCH.EXE Infected: Trojan-Downloader.Win32.Keenval.k skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM66.tmp/SETUP_INCREDIFIND_ONLY.EXE/data0002 Infected: Trojan-Downloader.Win32.Keenval.k skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM66.tmp/SETUP_INCREDIFIND_ONLY.EXE/data0003 Infected: Trojan-Downloader.Win32.Keenval.j skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM66.tmp/SETUP_INCREDIFIND_ONLY.EXE Infected: Trojan-Downloader.Win32.Keenval.j skipped
C:\Documents and Settings\Owner\Application Data\Iomega Automatic Backup\CacheFiles\IOM66.tmp ZIP: infected - 5 skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\all_files4.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\Data\all_files4.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\Data\netspry.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
C:\Documents and Settings\Owner\My Documents\J.J\My Documents\Data\netspry.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\My Documents\Just Stuff\setup.exe/data0002 Infected: Trojan-Downloader.Win32.Wren.d skipped
C:\Documents and Settings\Owner\My Documents\Just Stuff\setup.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Owner\My Documents\My downloads\aquarium-us.exe/ClrSchP048.exe Infected: Backdoor.Win32.Ruledor.c skipped
C:\Documents and Settings\Owner\My Documents\My downloads\aquarium-us.exe StarDust Installer: infected - 1 skipped
C:\Documents and Settings\Owner\My Documents\My downloads\halloween-us.exe/ClrSchP048.exe Infected: Backdoor.Win32.Ruledor.c skipped
C:\Documents and Settings\Owner\My Documents\My downloads\halloween-us.exe StarDust Installer: infected - 1 skipped
C:\Documents and Settings\Owner\My Documents\My downloads\snowglobe.exe/ClrSchP048.exe Infected: Backdoor.Win32.Ruledor.c skipped
C:\Documents and Settings\Owner\My Documents\My downloads\snowglobe.exe StarDust Installer: infected - 1 skipped
C:\Documents and Settings\Owner\My Documents\My downloads\snowing.exe/ClrSchP048.exe Infected: Backdoor.Win32.Ruledor.c skipped
C:\Documents and Settings\Owner\My Documents\My downloads\snowing.exe StarDust Installer: infected - 1 skipped
D:\Documents and Settings\Owner\My Documents\My downloads\halloween-us.exe/ClrSchP048.exe Infected: Backdoor.Win32.Ruledor.c skipped
D:\Documents and Settings\Owner\My Documents\My downloads\halloween-us.exe StarDust Installer: infected - 1 skipped
D:\Documents and Settings\Owner\My Documents\My downloads\snowglobe.exe/ClrSchP048.exe Infected: Backdoor.Win32.Ruledor.c skipped
D:\Documents and Settings\Owner\My Documents\My downloads\snowglobe.exe StarDust Installer: infected - 1 skipped
D:\Documents and Settings\Owner\My Documents\My downloads\snowing.exe/ClrSchP048.exe Infected: Backdoor.Win32.Ruledor.c skipped
D:\Documents and Settings\Owner\My Documents\My downloads\snowing.exe StarDust Installer: infected - 1 skipped
D:\Documents and Settings\Leas account\My Documents\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
D:\Documents and Settings\Leas account\My Documents\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
D:\Documents and Settings\Leas account\My Documents\Data\all_files4.exe NSIS: infected - 2 skipped
D:\Documents and Settings\Leas account\My Documents\Data\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
D:\Documents and Settings\Leas account\My Documents\Data\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
D:\Documents and Settings\Leas account\My Documents\Data\Data\all_files4.exe NSIS: infected - 2 skipped
D:\Documents and Settings\Leas account\My Documents\Data\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
D:\Documents and Settings\Leas account\My Documents\Data\Data\netspry.exe NSIS: infected - 1 skipped
D:\Documents and Settings\Leas account\My Documents\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
D:\Documents and Settings\Leas account\My Documents\Data\netspry.exe NSIS: infected - 1 skipped
D:\Documents and Settings\Bethany\My Documents\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
D:\Documents and Settings\Bethany\My Documents\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
D:\Documents and Settings\Bethany\My Documents\Data\all_files4.exe NSIS: infected - 2 skipped
D:\Documents and Settings\Bethany\My Documents\Data\Data\all_files4.exe/data0003 Infected: Trojan-Downloader.Win32.Agent.ec skipped
D:\Documents and Settings\Bethany\My Documents\Data\Data\all_files4.exe/data0006 Infected: Trojan.Win32.SecondThought.h skipped
D:\Documents and Settings\Bethany\My Documents\Data\Data\all_files4.exe NSIS: infected - 2 skipped
D:\Documents and Settings\Bethany\My Documents\Data\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
D:\Documents and Settings\Bethany\My Documents\Data\Data\netspry.exe NSIS: infected - 1 skipped
D:\Documents and Settings\Bethany\My Documents\Data\netspry.exe/data0002 Infected: Trojan.Win32.StartPage.aaq skipped
D:\Documents and Settings\Bethany\My Documents\Data\netspry.exe NSIS: infected - 1 skipped
Scan process completed.
Logfile of HijackThis v1.99.1
Scan saved at 11:08:01 PM, on 6/13/06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Common Files\Verizon Online\ConnMgr\cmisrv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Verizon Online\AppMgr\vzOpenUIServer.exe
C:\Program Files\Common Files\MotiveBrowser\MotiveBrowser.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\HijackThis\hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://verizon.yahoo.com
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [Iomega Automatic Backup 1.0.1] C:\Program Files\Iomega\Iomega Automatic Backup\ibackup.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [A Verizon App] C:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: WkCalRem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: RaptisoftGameLoader -
http://www.miniclip....tgameloader.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) -
https://activatemyds...oad/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky...can_unicode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
http://messenger.zon...nt.cab28578.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....k/?linkid=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) -
https://signup.msn.c...es/MsnInstC.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by7fd.bay7.ho...es/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
http://messenger.zon...nt.cab28578.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} -
http://clubgames.pog...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - F:\ADVTOOLS\NPROTECT.EXE (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - Unknown owner - C:\WINDOWS\wanmpsvc.exe (file missing)
How do I get rid of this mess? I obviously dont want it on my machine but I cant afford to buy a bunch of software right now.....are there freeware products that work good on things like this?
Edited by Tennafa, 13 June 2006 - 09:21 PM.