What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

7 days up second listing! Please help!

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi could someone help me?

I’ve had Project 1 on my PC. I’ve thrown all of the following at it:

AVG Anti-spy ware

Registry Mechanic

Adaware SE

CC Cleaner

My Pc now runs very slowly. Task manager shows up to 100% PCU usage even when idle with antivirus switched off! Occasionally I get the message:

Insufficient system resources when trying to run applications.

When I shut down I get either of the two messages:

MDHLHOST.EXE-DLL initialization failed

Hypetuio.exe initialization failed

This is my own PC and not the same machine as in my previous listings.



Attached Hijackthis log file and Kaspersky Report.




Logfile of HijackThis v1.99.1
Scan saved at 20:51:36, on 08/12/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Rosey.TIGER\My Documents\hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/broadband
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Intex Service Driver] msserv.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunServices: [Intex Service Driver] msserv.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CS2\Services\Tcpip\..\{0BB52860-78A2-4FB5-893F-E516A60144A2}: NameServer = 212.139.132.42 212.139.132.41
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Friday, December 08, 2006 9:48:00 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 8/12/2006
Kaspersky Anti-Virus database records: 235289
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 32153
Number of viruses found: 5
Number of infected objects: 123 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:47:07

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Rosey\sp.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\Documents and Settings\Rosey\sp.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\Documents and Settings\Rosey\sp.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\Documents and Settings\Rosey\sp.exe RarSFX: infected - 3 skipped
C:\Documents and Settings\Rosey.TIGER\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\Local Settings\History\History.IE5\MSHist012006120820061209\index.dat Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\Local Settings\Temp\ mon000.log Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Rosey.TIGER\UserData\index.dat Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\debug.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\debug.log.idx Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\error.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\error.log.idx Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\hips.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\hips.log.idx Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\ids.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\ids.log.idx Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\network.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\network.log.idx Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\system.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\system.log.idx Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\warning.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\warning.log.idx Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\web.log Object is locked skipped
C:\Program Files\Kerio\Personal Firewall 4\logs\web.log.idx Object is locked skipped
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP34\A0007079.exe Object is locked skipped
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP34\A0007080.exe Object is locked skipped
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP34\A0007081.exe Object is locked skipped
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP34\A0007083.exe Object is locked skipped
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP36\change.log Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP1\A0000002.bat Infected: Trojan.WinREG.Zapchast skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP3\A0000184.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP3\A0000185.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000191.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000201.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000228.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000236.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000237.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000238.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000240.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000240.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000240.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000240.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000477.bat Infected: Trojan.WinREG.Zapchast skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000495.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000501.EXE Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000502.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000502.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000502.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000502.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000504.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000505.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000518.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000519.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000543.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000544.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000545.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000546.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000547.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000548.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000549.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000550.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000552.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000552.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000552.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000552.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000553.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000558.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000693.EXE Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000877.bat Infected: Trojan.WinREG.Zapchast skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000891.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000892.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000894.EXE Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000899.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000913.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000914.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000918.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000928.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000928.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000928.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000928.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000930.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000931.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000937.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000937.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000937.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000937.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000939.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000940.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002951.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002952.dll Infected: Trojan.Win32.Crypt.t skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002953.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002972.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002972.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002972.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002972.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002974.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002975.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002982.dll Infected: Trojan.Win32.Crypt.t skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002983.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002984.dll Infected: Trojan.Win32.Crypt.t skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002985.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002986.exe Infected: Trojan.Win32.Crypt.t skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002989.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002989.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002989.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002989.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002991.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002992.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002996.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002997.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0004027.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0004028.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005030.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005030.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005030.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005030.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005031.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005032.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005038.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005038.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005038.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005038.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005039.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005040.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005044.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005046.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005047.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005056.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005057.exe Infected: Trojan.Win32.Dialer.ji skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005066.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005066.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005066.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005066.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005067.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005068.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005083.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005089.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005089.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005089.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005089.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005090.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005091.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005099.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005103.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005103.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005103.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005103.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005104.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005105.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005113.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005114.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005114.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005114.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005114.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005115.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005116.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005137.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005138.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005138.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005138.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005138.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005139.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005140.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005144.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005145.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005150.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005152.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005153.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005154.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005166.exe/data.rar/kansy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005166.exe/data.rar/kany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005166.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005166.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005170.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005173.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005182.exe/data.rar/ransy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005182.exe/data.rar/rany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005182.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005182.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005183.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005184.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005189.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005190.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005193.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005200.exe/data.rar/ransy.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005200.exe/data.rar/rany.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005200.exe/data.rar Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005200.exe RarSFX: infected - 3 skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005201.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005202.reg Infected: Trojan.WinREG.LowZones.f skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005207.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005208.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005209.exe Infected: not-virus:Hoax.Win32.Renos.c skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005210.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005212.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0008225.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0008228.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009243.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009258.exe Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009259.exe Infected: Trojan.Win32.Crypt.t skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009260.dll Object is locked skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009261.dll Infected: Trojan.Win32.Crypt.t skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009263.dll Infected: Trojan.Win32.Crypt.t skipped
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009268.exe Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\dgnbgeng.exe Infected: Trojan.Win32.Crypt.t skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.
Post #2
Rosey

Welcome To Tom Coyote, sorry for the delay

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

thanks bamajim
Post #3
Hi bamajim, Thanks in advance for your help! Combofix report bellow: Rosey Rosey - 06-12-19 15:56:32.70 Service Pack 1 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Rosey.TIGER\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\WINDOWS\system32\ASKS~1 C:\QooBox\Purity\WINDOWS\system32\PPATCH~1 ((((((((((((((((((((((((((((((( Files Created from 2006-11-19 to 2006-12-19 )))))))))))))))))))))))))))))))))) 2006-12-03 11:34 d——– C:\Program Files\SpywareBlaster 2006-12-03 09:34 d——– C:\Program Files\Spybot - Search & Destroy 2006-12-03 09:34 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2006-12-02 16:30 d——– C:\WINDOWS\system32\Kaspersky Lab 2006-12-02 16:23 d——– C:\bintheredunthat 2006-12-02 16:16 dr-h—– C:\$VAULT$.AVG 2006-12-02 15:53 816,672 –a—— C:\WINDOWS\system32\drivers\avg7core.sys 2006-12-02 15:53 4,224 –a—— C:\WINDOWS\system32\drivers\avg7rsw.sys 2006-12-02 15:53 3,968 –a—— C:\WINDOWS\system32\drivers\avgclean.sys 2006-12-02 15:53 28,416 –a—— C:\WINDOWS\system32\drivers\avg7rsxp.sys 2006-12-02 15:53 18,240 –a—— C:\WINDOWS\system32\drivers\avgmfx86.sys 2006-12-02 15:53 d——– C:\Program Files\Grisoft 2006-12-02 15:53 d——– C:\Documents and Settings\Rosey.TIGER\Application Data\AVG7 2006-12-02 15:53 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft 2006-12-02 15:53 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-03 10:21 ——– d——– C:\Program Files\joystick networks 2006-12-03 09:14 ——– d——– C:\Program Files\SpywareBot 2006-10-23 12:35 ——– d——– C:\Program Files\eMule (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background" "Intex Service Driver"="msserv.exe" "SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices] "Intex Service Driver"="msserv.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "HPHUPD05"="C:\\Program Files\\Hewlett-Packard\\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\\hphupd05.exe" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe\"" "HPHmon05"="C:\\WINDOWS\\System32\\hphmon05.exe" "adiras"="adiras.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "Smapp"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMTray.exe" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe" "Intex Service Driver"="" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "Intex Service Driver"="" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,df,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "Intec Service Drivers"="msconfig32x.exe" "Microsoft Config 32"="msconfigx32.exe" "Intex Service Driver"="msserv.exe" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices] "Intec Service Drivers"="msconfig32x.exe" "Intex Service Driver"="msserv.exe" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "Intec Service Drivers"="msconfig32x.exe" "Microsoft Config 32"="msconfigx32.exe" "Intex Service Driver"="msserv.exe" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runservices] "Intec Service Drivers"="msconfig32x.exe" "Intex Service Driver"="msserv.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000000 "DisableRegistryTools"=dword:00000000 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000000 "DisableRegistryTools"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\RpcClient Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\HP Usg Daily.job C:\WINDOWS\tasks\Windows Update.job Completion time: 06-12-19 15:58:32.14 C:\ComboFix.txt … 06-12-19 15:58 C:\ComboFix2.txt … 06-12-19 15:52
Post #4
rosey

You may want to print out these instructions for reference

1.We need to make sure we can see hidden files and folders

To enable the viewing of Hidden and System files follow these steps: Right click on Start and select Explore.
Select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Click Yes To confirm
Press the Apply button and then the OK button.
2. We need to temporarily disable SpyBot S&D TeaTimer 1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
5) Restart your computer.
3.Open Notepad (Not Wordpad)
Copy and paste the following into notepad
(Making sure there is no space between the top of the window and the first line)

REGEDIT4

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Intex Service Driver"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices]
"Intex Service Driver"=- 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Intex Service Driver"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Intec Service Drivers"=-
"Microsoft Config 32"=-
"Intex Service Driver"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"Intec Service Drivers"=-
"Intex Service Driver"=-

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Intec Service Drivers"=-
"Microsoft Config 32"=-
"Intex Service Driver"=-

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runservices]
"Intec Service Drivers"=-
"Intex Service Driver"=-
After you copy and paste it your cursor should be at the end of the first line
Hit Enter so your cursor is under the last lineClick File->>Save as->>type in fix.reg->>
Under "Save as type" Select "All Files"->> save it to your Desktop
Close Notepad
The fix.reg file should now appear on your Desktop

Rt Click and Select merge If prompted do you want to merge this Select Yes(it will appear that nothing has happened but that's o.k.)

4. Rerun Hijackthis (scan only) and place checks beside the following entriesR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [Intex Service Driver] msserv.exe
O4 - HKCU\..\RunServices: [Intex Service Driver] msserv.exe

Close all other open windows except Hijackthis and Select "Fix checked"

If prompted to reboot Select No and close Hijackthis

5. Using Windows Explorer(Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)
Locate and Delete the following filesC:\bintheredunthat
C:\Documents and Settings\Rosey\sp.exe
C:\WINDOWS\system32\dgnbgeng.exe
C:\WINDOWS\tasks\Windows Update.job
Close Windows Explorer->>Reboot your PC->>Rerun Hijackthis and post a fresh log

thanks bamajim
Post #5
Hi bamajim,

Ok all done, she's become faster and more stable!

However the following didn't appear when I ran the HijackThis scan:

R3 - Default URLSearchHook is missing
O4 - HKCU\..\Run: [Intex Service Driver] msserv.exe
O4 - HKCU\..\RunServices: [Intex Service Driver] msserv.exe

The 'about blank' keys were there and I ran the fix with these checked.

Everything else worked out fine! New Hijackthis log attached.

Many Thanks

Rosey


Logfile of HijackThis v1.99.1
Scan saved at 20:04:42, on 19/12/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Rosey.TIGER\My Documents\hijackthis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/broadband
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BB52860-78A2-4FB5-893F-E516A60144A2}: NameServer = 212.139.132.41 212.139.132.42
O17 - HKLM\System\CS1\Services\Tcpip\..\{0BB52860-78A2-4FB5-893F-E516A60144A2}: NameServer = 212.139.132.41 212.139.132.42
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Post #6
rosey

Good job

The missing entries in Hijackthis were because of the Regfix we did, but I included them 'just in case'

You indicated in your first post that you used AVG anti-spyware, but what you have is AVG Anti-virus which is good but we are to going to use Anti- Spyware now

Go here and Download AVG Anti-Spyware
(30 day free trial version) Save it to Your Desktop
 
Double Click AVG Anti-Spyware-setup
(It will create its own folder)
Once the program starts You will be at the Status menuUnder "Your computers Security"
Click change status on Resident shield to inactive
Click Update now (next to last update)
After the update loads
Under Automatic updates Uncheck download and install updates automatically(recommended)
(you can always select maual updates the next day)
At the top toolbar Click Scanner Then the settings tabUnder How to act? Set default action for detected malwareTo Quarantine
Under how to scan All boxes should be checked
Under Possibly unwanted software All boxes should be checked
Under reports Select Automatically generate report after every scan
Uncheck Only if threats were found
Under what to scan Scan every file should be highlited
Exit AVG(But do not run it yet)
 
Reboot into Safe Mode
This can be done byRestart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter
Run AVG Anti-SpywareClick scanner
Select Complete system scan
Once the scan finishesSelect Apply all actions (The items found will be quarantined)
Click save report as (Another window will open)
Save it to your desktop
(By default It will be saved in the AVG folder as)
C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports
Exit AVG
 
Reboot your PC in Normal Mode->>Re run Hijackthis and post a fresh Hijackthis log.Double click the report-scan txt. you saved to your desktop
It will open in Notepad
Copy and paste that report as a reply to this thread
Your reply should includea fresh Hijackthis log
your report_scan.txt log from AVG
thanks bamajim
Post #7
Hi bamajim

Ok, no problems there, both log files bellow.


Logfile of HijackThis v1.99.1
Scan saved at 22:11:13, on 19/12/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Rosey.TIGER\My Documents\hijackthis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/broadband
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BB52860-78A2-4FB5-893F-E516A60144A2}: NameServer = 212.139.132.41 212.139.132.42
O17 - HKLM\System\CS1\Services\Tcpip\..\{0BB52860-78A2-4FB5-893F-E516A60144A2}: NameServer = 212.139.132.41 212.139.132.42
O17 - HKLM\System\CS2\Services\Tcpip\..\{0BB52860-78A2-4FB5-893F-E516A60144A2}: NameServer = 212.139.132.6 212.139.132.7
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe



———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 21:57:41 19/12/2006

+ Scan result:



C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002954.exe -> Adware.Apropos : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009248.exe -> Adware.Apropos : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000206.exe -> Adware.BargainBuddy : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0008266.exe -> Adware.BargainBuddy : No action taken.
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP27\A0005695.exe -> Adware.BetterInternet : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0001933.exe -> Adware.BetterInternet : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002962.dll -> Adware.BetterInternet : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002961.ocx -> Adware.DelphinMediaViewer : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000511.dll -> Adware.Puper : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000897.dll -> Adware.Puper : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005214.dll -> Adware.Puper : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000197.ini -> Adware.Sahat : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000672.ini -> Adware.Sahat : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005080.ini -> Adware.Sahat : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005135.ini -> Adware.Sahat : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000692.dll -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\snapshot\MFEX-1.DAT -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\snapshot\MFEX-3.DAT -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\snapshot\MFEX-4.DAT -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000919.dll -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005151.dll -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005171.exe -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005174.dll -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005191.exe -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005194.dll -> Adware.Searcher : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005213.dll -> Adware.Searcher : No action taken.
C:\Program Files\SpywareBot -> Adware.SpywareBot : No action taken.
C:\Program Files\SpywareBot\HOSTS Backups -> Adware.SpywareBot : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000231.exe -> Adware.WinAD : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000232.exe -> Adware.WinAD : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009235.exe -> Adware.WinAD : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009236.exe -> Adware.WinAD : No action taken.
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP34\A0007080.exe -> Dropper.Small.acl : No action taken.
C:\System Volume Information\_restore{10770A5E-C8C4-48ED-83FE-02171A2675BC}\RP34\A0007081.exe -> Dropper.Small.acl : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005209.exe -> Not-A-Virus.Hoax.Win32.Renos.c : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002952.dll -> Trojan.Crypt.t : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002982.dll -> Trojan.Crypt.t : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002984.dll -> Trojan.Crypt.t : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002986.exe -> Trojan.Crypt.t : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009259.exe -> Trojan.Crypt.t : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009261.dll -> Trojan.Crypt.t : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009263.dll -> Trojan.Crypt.t : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005057.exe -> Trojan.Dialer.ji : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP3\A0000184.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP3\A0000185.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000237.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000238.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000504.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000505.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000549.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000550.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000913.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000914.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000930.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000931.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000939.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0000940.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002974.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002975.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002991.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0002992.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0004027.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0004028.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005030.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005030.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005031.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005032.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005038.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005038.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005039.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005040.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005066.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005066.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005067.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005068.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005089.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005089.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005090.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005091.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005103.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005103.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005104.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005105.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005114.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005114.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005115.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005116.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005138.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005138.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005139.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005140.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005166.exe/kansy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005166.exe/kany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005182.exe/ransy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005182.exe/rany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005183.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005184.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005200.exe/ransy.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005200.exe/rany.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005201.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005202.reg -> Trojan.LowZones.f : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0005061.exe -> Trojan.Small : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP6\A0009246.exe -> Trojan.Small : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP1\A0000002.bat -> Trojan.Zapchast : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP4\A0000477.bat -> Trojan.Zapchast : No action taken.
C:\System Volume Information\_restore{C221294D-FD1E-436A-884E-6AFF754E968C}\RP5\A0000877.bat -> Trojan.Zapchast : No action taken.


::Report end
Post #10
rosey

Great news. Almost there

1. Disable and Enable System RestoreLets create a clean System Restore point
the instructions are here
2. You are currently Running XP SP1(service pack 1) which has many security flaws. The current version is SP2 (service pack 2)

Go HERE download and install SP2. It's a rather large download, about 2 hrs., but it is a must have. Without this OS upgrade you stand a good chance of re-infection. After you download and install SP2->>Rerun Hijackthis and post a fresh log so I can see that it installed properly.

If you have any problems please reply, if not I'll look forward to a fresh Hijackthis log.

thanks bamajim

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI