smitfraud + winlogonhook please help!

Hi mccosh1608 - We are currently studying your log and will have instructions for you shortly. Thank you for your patience.

OK. thank you so much for helping me

Hi,

Welcome to Tom Coyote! You have several infections, so it will take several steps in cleaning your system.

• Re-name HijackThis.exe to hjt.exe by doing the following:
- Navigate to C:\Program Files\Hijackthis\
- Right-click onto HijackThis.exe and select "Rename"
- Type hjt.exe and hit Enter.

• Now, double-click onto hjt.exe (which is still hijackthis) and post back with the new HijackThis log.

Hi,

Please do the following.

• Download VundoFix.exe and save it to your desktop.
- Double-click VundoFix.exe to run it
- Put a check next to Run Vundo Fix as a task
- You will receive a message saying Vundofix will close and re-open in a minute or two
- Click OK
- When VundoFix re-opens, click the Scan for Vundo button
- Once it is done scanning, click the Remove Vundo button
- You will receive a prompt asking if you want to remove the files
- Click YES
- Once you click YES, your desktop will go blank as it starts removing Vundo
- When completed, it will prompt that it will shutdown your computer
- Click OK
- Turn your computer back on.
- Please run VundoFix only one time.
If you run it more than one time, you will overwrite the original log generated when it was run the first time.

• Download SmitfraudFix by S!ri and save it to your dekstop.
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.
- Open the SmitfraudFix folder and double-click smitfraudfix.cmd
- Select option #1 - Search by typing 1 and press Enter
- This program will scan large amounts of files on your computer for known patterns, so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt on the root of your drive, e.g.: Local Disk C: or partition where your operating system is installed. You will be requested to post this log in your next reply along with any other requested logs.

Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc…processutil.htm

IMPORTANT: Do NOT run any other options until you are asked to do so!

• Post back with the contents of C:\vundofix.txt, the contents of the rapport.txt and a new HijackThis log.

Hi,

Well, I see the hidden vundo infection now as well as the smitfraud infection. You will need to run VundoFix again but note that there are additional steps to perform.

• First, open HijackThis, click Open the Misc Toos section, then click Delete a file on bootup
- a window will open
- Where it says "File Name" - copy and paste: C:\Windows\System32\winhoq32.dll
- Click Open
- A prompt will appear advising you that the file will be deleted and asking if you want to reboot now
- Click Yes
- Your computer will now reboot.

• Then, double-click VundoFix.exe to run it.

• Put a check next to Run VundoFix as a task.
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
• When VundoFix re-opens, click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• In case it says that nothing was been found, Right click the list box (white box) in the main VundoFix window.
• Select “Add More Files?” from the menu that comes up. This will open a new VundoFix window.
• In the Window: copy and paste next in the first field: C:\WINDOWS\System32\jkhfd.dll
• Copy and paste next in the second field: C:\WINDOWS\System32\efcdebb.dll
• Click the “Add Files” button.
• Click the "Close Window" button.
• Click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.

• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Hi,

The ishost.exe file is part of smitfraud infection which we're going to clean now. Please follow these instructions exactly and in the order given. You will need to print or copy these directions as you will be working in Safe Mode without an Internet connection.

• Download SmitfraudFix by S!ri and save it to your dekstop.
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.
Do NOT run the program yet.

• Download and install Ewido Anti-Spyware 4
1. After download, double click on the file to launch the install process.
2. Choose a language, click "OK" and then click "Next".
3. Read the "License Agreement" and click "I Agree".
4. Accept the default installation path: C:\Program Files\ewido anti-spyware 4.0 and click "Next", then click "Install".
5. After setup completes, click "Finish" to start the program automatically or launch ewido by double-clicking its icon on your desktop or in the system tray.
6. The main "Status" menu will appear. You can select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'. If you choose to do this, then right click on ewdio in the system tray and uncheck "Start with Windows".
7. Go to Start > Run and type: services.msc

• Press "OK".
• In Services, click the "Extended tab" and scroll down the list to find ewido anti-spyware 4.0 guard.
• When you find the guard service, double-click on it.
• In the Properties Window > General Tab that opens, click the "Stop" button.
• From the drop-down menu next to "Startup Type", click on "Disabled".
• Now click "Apply", then "OK" and close the Services window.

8. Select the "Update" button and click "Start update". If you are having problems with the updater, manually update with the Ewido Full database installer from here.
9. Exit Ewido when done.
Do NOT perform a scan yet.

• Reboot into SAFE MODE.
To get into the Windows XP Safe Mode, restart your computer and, just before Windows starts to load, tap the F8 key a few times. Choose Safe Mode from the menu that will appear and press Enter.

• Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

• Clean out your Temporary Internet files. Proceed like this:

• Close Internet Explorer and ALL browsers/open windows/open programs.
• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete Files under Temporary Internet Files.
• In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
• Click OK.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin

Close ALL open Windows / Programs / Folders.

• Start Ewido, and run a full scan.

• Click on Scanner
• Click on Settings
  • Under How to scan all boxes should be checked
  • Under Unwanted Software all boxes should be checked
  • Under What to scan select Scan every file
  • Click on Ok
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.

If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections and put a checkmark in the box next to Create encrypted backup, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.
- Click Save Report button
- Save the report to your Desktop
- Close Ewido

• Reboot back into Normal Mode.

• Post back with the rapport.txt, the results of the Ewido scan and a new HijackThis log.

Hi,

One important note regarding Ewido:
Do NOT save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button?

Also.. I have ToolBar888 in my Add/Remove list and uninstalling it from there does nothing… it just stays there

Hi,

Okay, again please follow these instructions exactly and in the order given. You will need to print or copy these directions as you will again be working in Safe Mode without an Internet connection.

• Disable your Symantec Script Blocking from within your Norton so it does not interfere with anything during our fixes now or later. You can enable this whenever we have verified that your system is clean.
To disable Norton AntiVirus Script Blocking:
1. Start Norton AntiVirus.
If Norton AntiVirus is installed as part of Norton SystemWorks or Norton Internet Security, then start that program.
2. Click Options.
If you see a menu, click Norton AntiVirus.
3. In the left pane, click Script Blocking.
4. In the right pane, uncheck Enable Script Blocking (recommended).
5. Click OK.

Reboot your computer!

• Uninstall the following programs if present
- Go to Start -> Control Panel -> Add/Remove Programs
- Select the following, one at a time, and click Remove for each one
ToolBar888
Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
Cowabanga by OIN
or anything similar with Oin in it

If OIN not listed, download and run this uninstaller
http://www.outerinfo.com/OiUninstaller.exe

Reboot when done! This is very important!

• Please set your system to show all files.
- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View Tab. Under the Hidden files and folders heading, select Show hidden files
and folders.
- Uncheck: Hide file extensions for known file types
- Uncheck the Hide protected operating system files (recommended) option.
- Click Yes to confirm.
- Click OK.

• Double-click VundoFix.exe to run it.
• Put a check next to Run VundoFix as a task.
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
• When VundoFix re-opens, click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• In case it says that nothing was been found, Right click the list box (white box) in the main VundoFix window.
• Select “Add More Files?” from the menu that comes up. This will open a new VundoFix window.
• In the Window: copy and paste next in the first field: C:\WINDOWS\System32\jkkjg.dll
• Copy and paste next in the second field: C:\WINDOWS\System32\gjkkj.*
• Click the “Add Files” button.
• Click the "Close Window" button.
• Click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.

• Restart your computer and, just before Windows starts to load, tap the F8 key a few times. Choose Safe Mode from the menu that will appear and press Enter.

• Start HijackThis, click System Scan Only and place a checkmark next to the following items:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {9F44C554-78D4-4040-B97D-B8499B92366A} - C:\WINDOWS\system32\jkkjg.dll
O4 - HKCU\..\Run: [5663fa86.exe] C:\Documents and Settings\Owner\Local Settings\Application Data\5663fa86.exe
O20 - AppInit_DLLs: tracert.dll C:\WINDOWS\system32\tracert.dll
O20 - Winlogon Notify: jkkjg - C:\WINDOWS\system32\jkkjg.dll

Close ALL browsers and open windows/programs except HijackThis and click 'Fix Checked'.

• Navigate to C:\Program Files\ and delete the following folders if present:
ToolBar888
Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
Cowabanga by OIN
or anything similar with Oin in it

• Navigate to and delete the following files if present:
C:\Documents and Settings\Owner\Local Settings\Application Data\5663fa86.exe
C:\Windows\system32\tracert.dll
C:\Windows\system32\jkkjg.dll

• Reboot into Normal Mode

• Please perform this online scan: Kaspersky Online Scanner
1. Read the Requirements and Privacy statement, then select Accept
2. A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
3. Select Install to download the ActiveX controls that allows ActiveScan to run.
4. If running MS Windows Defender you may receive an alert that an IE ActiveX program requires your approval. Click Allow
5. When the download is complete it will say ready, click Next
6. Click Scan Settings and check the option to use the EXTENDED DATABASE, then click OK
7. Select a target to scan: Click on My Computer
8. When the scan is complete choose to save the results as Save as Text

• Post back with the contents of the C:\vundofix.txt, the results of the Kaspersky Online Scan and a new HijackThis log. Also, let me know how your computer is running now.

VundoFix V5.1.7 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Java version is 1.4.2.3 Java version is 1.4.2.6 Java version is 1.5.0.4 Java version is 1.5.0.6 Scan started at 12:22:09 AM 8/10/2006 Listing files found while scanning…. No infected files were found. Beginning removal… Beginning removal.. *************************************************************** ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Thursday, August 10, 2006 9:32:50 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 10/08/2006 Kaspersky Anti-Virus database records: 213712 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ H:\ Scan Statistics: Total number of scanned objects: 96874 Number of viruses found: 10 Number of infected objects: 25 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:12:06 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\LocalService.NT AUTHORITY.000\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Desktop\HijackThis\backups\backup-20060808-222728-418.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\Documents and Settings\Owner\Desktop\OiUninstaller.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\Documents and Settings\Owner\Desktop\OiUninstaller.exe NSIS: infected - 1 skipped C:\Documents and Settings\Owner\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012006081020060811\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_5c0.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_fc0.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT.LOG Object is locked skipped C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton AntiVirus\Quarantine\09895A87 Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\098C0484 Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\15375E8C.exe Infected: Worm.Win32.VB.an skipped C:\Program Files\Norton AntiVirus\Quarantine\1F5D7E5B Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\49B74109 Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\51913216.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\537B00D2.pif Infected: IM-Worm.Win32.Opanki.am skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP493\A0078115.exe Infected: Trojan-Clicker.Win32.Delf.az skipped C:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP493\A0078116.exe Infected: Trojan-Clicker.Win32.Delf.az skipped C:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP494\A0078291.exe Infected: Trojan-Clicker.Win32.Delf.az skipped C:\WINDOWS\$_hpcst$.hpc Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{D530D8A0-F2F8-40E2-97B3-80ACB070E93F}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\cbxuvss.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped C:\WINDOWS\system32\efccyvu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\efcdebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\hggdaxx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\ljjifdd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_f8.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP493\A0078124.exe Infected: Trojan-Clicker.Win32.Delf.az skipped Scan process completed. **************************************************************************************** ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Thursday, August 10, 2006 9:32:50 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 10/08/2006 Kaspersky Anti-Virus database records: 213712 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ H:\ Scan Statistics: Total number of scanned objects: 96874 Number of viruses found: 10 Number of infected objects: 25 / 0 Number of suspicious objects: 0 Duration of the scan process: 02:12:06 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\LocalService.NT AUTHORITY.000\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY.000\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY.000\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Desktop\HijackThis\backups\backup-20060808-222728-418.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\Documents and Settings\Owner\Desktop\OiUninstaller.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\Documents and Settings\Owner\Desktop\OiUninstaller.exe NSIS: infected - 1 skipped C:\Documents and Settings\Owner\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012006081020060811\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_5c0.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_fc0.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT.LOG Object is locked skipped C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton AntiVirus\Quarantine\09895A87 Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\098C0484 Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\15375E8C.exe Infected: Worm.Win32.VB.an skipped C:\Program Files\Norton AntiVirus\Quarantine\1F5D7E5B Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\49B74109 Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Program Files\Norton AntiVirus\Quarantine\51913216.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\51945C12.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\537B00D2.pif Infected: IM-Worm.Win32.Opanki.am skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP493\A0078115.exe Infected: Trojan-Clicker.Win32.Delf.az skipped C:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP493\A0078116.exe Infected: Trojan-Clicker.Win32.Delf.az skipped C:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP494\A0078291.exe Infected: Trojan-Clicker.Win32.Delf.az skipped C:\WINDOWS\$_hpcst$.hpc Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{D530D8A0-F2F8-40E2-97B3-80ACB070E93F}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\cbxuvss.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped C:\WINDOWS\system32\efccyvu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\efcdebb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\hggdaxx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\ljjifdd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.by skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_f8.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{58E67FCB-8E15-416F-9B90-0BE3A1D28D11}\RP493\A0078124.exe Infected: Trojan-Clicker.Win32.Delf.az skipped Scan process completed. Everything seems to be running normal. No popups and the startup has gotten much faster.. Also before explorer.exe would stay running in safe mode and now does… Is the kaspersky scan saying i have more infections still or are those ignorable?