ads.k8l.info (cont.)

I had a problem with ads.k8l.info earlier, here are my logs…



COMBOFIX LOG

"Owner" - 07-01-22 16:20:21 Service Pack 2
ComboFix 07-01-21 - Running from: "C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Desktop"

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))

REGISTRY ENTRIES REMOVED:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{8a550b29-6727-4403-81cb-30368fc1d616}]Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{5c502be8-2c76-4f3f-9ebd-55b7c8913609}]Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{85599ef8-27fb-4ca6-946b-85dccf5b8db7}]Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{69160f9a-5992-40e9-b7ed-267438281b20}]
@=""

[HKEY_CLASSES_ROOT\clsid\{69160f9a-5992-40e9-b7ed-267438281b20}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{69160f9a-5992-40e9-b7ed-267438281b20}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{69160f9a-5992-40e9-b7ed-267438281b20}\InprocServer32]
@="C:\\WINDOWS\\system32\\tcpelib.dll"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{bf4b3e05-fa10-4530-866d-539d3f6ec846}]
@=""

[HKEY_CLASSES_ROOT\clsid\{bf4b3e05-fa10-4530-866d-539d3f6ec846}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{bf4b3e05-fa10-4530-866d-539d3f6ec846}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{bf4b3e05-fa10-4530-866d-539d3f6ec846}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\clsid\{12bfb5e8-1580-4b24-a4d0-3c499fc154b2}]
@=""

[HKEY_CLASSES_ROOT\clsid\{12bfb5e8-1580-4b24-a4d0-3c499fc154b2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{12bfb5e8-1580-4b24-a4d0-3c499fc154b2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{12bfb5e8-1580-4b24-a4d0-3c499fc154b2}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Granting SeDebugPrivilege to Administrators … successful

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ysysvr2d.exe
C:\DOCUME~1\OWNER~1.DER\Application Data\Sskknwrd.dll
C:\DOCUME~1\OWNER~1.DER\Application Data\Sskuknwrd.dll
C:\INSTALL.LOG
C:\uniq
C:\DOCUME~1\LOCALS~1.NTA\Application Data\NetMon
C:\DOCUME~1\NETWOR~1.NTA\Application Data\NetMon

((((((((((((((((((((((((((((((( Files Created from 2006-12-22 to 2007-01-22 ))))))))))))))))))))))))))))))))))

2007-01-21 13:26 d—-c— C:\My Video
2007-01-21 13:22 420,240 –a—— C:\WINDOWS\system32\mpg4c32.dll
2007-01-21 13:21 991,232 –a—— C:\WINDOWS\system32\NCTVideoCoreM.dll
2007-01-21 13:21 90,112 –a—— C:\WINDOWS\system32\NCTAudioFormatSettings3.dll
2007-01-21 13:21 356,352 –a—— C:\WINDOWS\system32\NCTVideoDxPlayer.dll
2007-01-21 13:21 294,912 –a—— C:\WINDOWS\system32\NCTAVIFile.dll
2007-01-21 13:21 282,624 –a—— C:\WINDOWS\system32\NCTQuickTimeFile.dll
2007-01-21 13:21 2,658,304 –a—— C:\WINDOWS\system32\NCTAudioCompress3.dll
2007-01-21 13:21 2,260,992 –a—— C:\WINDOWS\system32\NCTVideoCompress.dll
2007-01-21 13:21 196,608 –a—— C:\WINDOWS\system32\NCTWMVFile.dll
2007-01-21 13:21 139,264 –a—— C:\WINDOWS\system32\NCTVideoFile.dll
2007-01-21 13:21 1,810,432 –a—— C:\WINDOWS\system32\NCTAudioCompress2.dll
2007-01-21 13:21 1,245,184 –a—— C:\WINDOWS\system32\NCTRMFile.dll
2007-01-21 13:20 793,536 –a—— C:\WINDOWS\system32\wmpcdcs8.exe
2007-01-21 13:20 237,568 –a—— C:\WINDOWS\system32\lame_enc.dll
2007-01-21 13:20 d——– C:\WINDOWS\system32\RMBin
2007-01-21 13:13 487,424 –a—— C:\WINDOWS\system32\msvcp70.dll
2007-01-21 13:13 1,700,352 –a—— C:\WINDOWS\system32\gdiplus.dll
2007-01-21 13:11 d——– C:\Program Files\Kingdia Software
2007-01-21 05:16 28,672 –a—— C:\WINDOWS\system32\AVEQ.dll
2007-01-21 04:36 499,712 –a—— C:\WINDOWS\system32\MSVCP71.DLL
2007-01-21 04:36 395,776 –a—— C:\WINDOWS\system32\libmplayer.dll
2007-01-21 04:36 348,160 –a—— C:\WINDOWS\system32\MSVCR71.DLL
2007-01-21 04:36 34,820 –a—— C:\WINDOWS\system32\ffdshow.reg
2007-01-21 04:36 262,144 –a—— C:\WINDOWS\system32\TomsMoComp_ff.dll
2007-01-21 04:36 2,255,360 –a—— C:\WINDOWS\system32\libavcodec.dll
2007-01-21 04:36 14,909 –a—— C:\WINDOWS\system32\A_reg.reg
2007-01-21 04:36 112,640 –a—— C:\WINDOWS\system32\libmpeg2_ff.dll
2007-01-21 04:36 1,060,864 –a—— C:\WINDOWS\system32\MFC71.DLL
2007-01-21 00:26 845,312 –a—— C:\WINDOWS\system32\Smab.dll
2007-01-21 00:26 719,872 –a—— C:\WINDOWS\system32\devil.dll
2007-01-21 00:26 70,656 –a—— C:\WINDOWS\system32\yv12vfw.dll
2007-01-21 00:26 70,656 –a—— C:\WINDOWS\system32\i420vfw.dll
2007-01-21 00:26 66,560 –a—— C:\WINDOWS\MOTA113.exe
2007-01-21 00:26 502,784 –a—— C:\WINDOWS\x2.64.exe
2007-01-21 00:26 306,688 –a—— C:\WINDOWS\system32\avisynth.dll
2007-01-21 00:26 27,648 –a—— C:\WINDOWS\system32\AVSredirect.dll
2007-01-21 00:26 240,128 –a—— C:\WINDOWS\system32\x.264.exe
2007-01-21 00:26 217,073 –a—— C:\WINDOWS\meta4.exe
2007-01-21 00:26 d–hs—- C:\WINDOWS\system32\ShellDHCP
2007-01-21 00:26 d——– C:\Program Files\AviSynth 2.5
2007-01-21 00:25 163,328 -r-hs—- C:\WINDOWS\system32\flvDX.dll
2007-01-21 00:24 d——– C:\Program Files\eRightSoft
2007-01-20 23:37 d——– C:\Program Files\FLVPlayer
2007-01-20 23:36 d—-c— C:\Downloads
2007-01-20 23:36 d——– C:\DOCUME~1\OWNER~1.DER\Application Data\GetRightToGo
2007-01-18 15:26 d——– C:\DOCUME~1\OWNER~1.DER\Application Data\Viewpoint
2007-01-14 17:18 d—-c— C:\DOCUME~1\ALLUSE~1.WIN\Application Data\Adobe
2007-01-14 17:10 d——– C:\Program Files\iTunes
2007-01-14 17:10 d——– C:\Program Files\iPod
2007-01-14 17:05 d——– C:\Program Files\QuickTime
2007-01-14 17:04 d——– C:\Program Files\Apple Software Update
2007-01-14 17:01 d——– C:\Program Files\RADVideo
2007-01-10 03:47 d——– C:\Program Files\OpenVideoConverter
2007-01-10 03:14 d——– C:\WINDOWS\system32\SoftwareDistribution
2007-01-10 03:14 d——– C:\WINDOWS\system32\PreInstall
2007-01-10 03:05 d–h—– C:\WINDOWS\$hf_mig$
2007-01-10 00:12 18,200 –a—— C:\WINDOWS\system32\wups2.dll
2007-01-09 23:08 d—-c— C:\!KillBox
2007-01-09 21:49 d——– C:\Program Files\Lavasoft
2007-01-09 21:02 d——– C:\DOCUME~1\OWNER~1.DER\Application Data\System Restore

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-21 18:09 10856 –ahs—- C:\WINDOWS\system32\kgygaavl.sys
2007-01-21 05:10 ——– d——– C:\Program Files\codec pack - all in 1
2007-01-21 05:08 737280 –a–c— C:\WINDOWS\iun6002.exe
2007-01-20 23:37 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\getrighttogo
2007-01-19 17:06 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\bittorrent
2007-01-18 15:26 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\viewpoint
2007-01-15 14:13 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\limewire
2007-01-14 17:22 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\apple computer
2007-01-14 17:19 ——– d——– C:\Program Files\Common Files\adobe
2007-01-14 17:19 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\adobe
2007-01-14 15:14 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\adobeum
2007-01-11 03:01 ——– d——– C:\Program Files\messenger
2007-01-10 13:27 ——– d——– C:\Program Files\tvu player
2007-01-09 23:46 ——– d–h—– C:\Program Files\windowsupdate
2007-01-09 22:34 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\lavasoft
2007-01-09 21:02 ——– d——– C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\system restore
2007-01-08 18:19 ——– d——– C:\Program Files\bittorrent
2006-12-07 01:40 2362184 –a—— C:\WINDOWS\system32\wmvcore.dll
2006-11-08 00:06 679424 –a—— C:\WINDOWS\system32\inetcomm.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"PID41IER.exe "="C:\\WINDOWS\\system32\\PID41IER.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE"
"McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^dukt.exe]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\dukt.exe"
"backup"="C:\\WINDOWS\\pss\\dukt.exeCommon Startup"
"location"="Common Startup"
"command"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\dukt.exe"
"item"="dukt"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Install Pending Files.LNK]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\Install Pending Files.LNK"
"backup"="C:\\WINDOWS\\pss\\Install Pending Files.LNKCommon Startup"
"location"="Common Startup"
"command"="C:\\Program Files\\SIFXINST\\SIFXINST.EXE /ApplyPending"
"item"="Install Pending Files"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIGStream]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="digstream"
"hkey"="HKLM"
"command"="C:\\Program Files\\DIGStream\\digstream.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hgqhp.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hgqhp"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\hgqhp.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hkcmd"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\hkcmd.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="igfxtray"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\igfxtray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SOUNDMAN"
"hkey"="HKLM"
"command"="SOUNDMAN.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsync]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ngpudp"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\ngpudp.exe reg_run"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="KATRACK.DLL"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
"vfdj.exe"="C:\\WINDOWS\\system\\vfdj.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: 07-01-22 16:25:32


FIXWAREOUT LOG

Check for missing files
…..
C:\WINDOWS\system32\AUTOEXEC.NT not there
…..
End check for missing files
…..
please post this at the forum


HIJACKTHIS LOG

Logfile of HijackThis v1.99.1
Scan saved at 4:32:00 PM, on 1/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Desktop Stuff\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bussolaweb.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {5ABB26D0-589C-8EC0-50A7-8E6173427BB5} - C:\WINDOWS\system32\sdkrk.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Class - {B35C1395-AB2D-BEE6-55AE-F8D331D7F30B} - C:\WINDOWS\system32\ieea32.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PID41IER.exe ] C:\WINDOWS\system32\PID41IER.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ad.searchsquire.com
O15 - Trusted Zone: http://search.searchsquire.com
O15 - Trusted Zone: http://update.searchsquire.com
O15 - Trusted Zone: http://www.searchsquire.com
O15 - Trusted Zone: http://*.searchsquire.com
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\umfnlqob.exe
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab
O16 - DPF: {4AD73894-A895-4FC2-B233-299867E08753} - http://apps.deskwizz.com/ax/adwerkz.cab
O16 - DPF: {5F3B3060-09E0-44C6-86F7-BC7B02B57BEE} - http://downloads.shopathomeselect.com/adpe…tall_ap1001.cab
O16 - DPF: {C0B285F6-DB2B-4908-9C58-F6D95397D747} - http://www.pacimedia.com/install/pcs_0015.exe
O16 - DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} - http://deposito.hostance.net/dialer/605041.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7CF9B3FA-F88C-4271-BF6C-E84BBA037FC1}: NameServer = 85.255.116.166,85.255.112.224
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3EEFC85-AABB-4933-BAF9-B95532834B1C}: NameServer = 85.255.116.166,85.255.112.224
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: KATRACK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISEXEng - Unknown owner - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

Logfile of HijackThis v1.99.1
Scan saved at 4:14:17 PM, on 2/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Desktop Stuff\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PID41IER.exe ] C:\WINDOWS\system32\PID41IER.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://ad.searchsquire.com
O15 - Trusted Zone: http://search.searchsquire.com
O15 - Trusted Zone: http://update.searchsquire.com
O15 - Trusted Zone: http://www.searchsquire.com
O15 - Trusted Zone: http://*.searchsquire.com
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: KATRACK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISEXEng - Unknown owner - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, February 06, 2007 9:35:43 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 7/02/2007
Kaspersky Anti-Virus database records: 265635
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 45409
Number of viruses found: 39
Number of infected objects: 107 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:03:30

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\msw\msw_uninstall.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.Searcher.h skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\msw\msw_uninstall.exe/WISE0007.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\msw\msw_uninstall.exe WiseSFX: infected - 2 skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\Agent_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\PrdMgr_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF1179.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF1189.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped
C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream.a skipped
C:\Program Files\ProcManager.exe Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\quarantine\adv585[1].htm.Vir Infected: Exploit.HTML.ObjData skipped
C:\quarantine\adv655[1].htm.Vir Infected: Exploit.HTML.ObjData skipped
C:\quarantine\adv655[1].htm.Vir.0 Infected: Exploit.HTML.ObjData skipped
C:\quarantine\arr3[1].jar.Vir/Counter.class Infected: Trojan.Java.ClassLoader.i skipped
C:\quarantine\arr3[1].jar.Vir/VerifierBug.class Infected: Trojan.Java.ClassLoader.k skipped
C:\quarantine\arr3[1].jar.Vir/Beyond.class Infected: Trojan.Java.ClassLoader.k skipped
C:\quarantine\arr3[1].jar.Vir ZIP: infected - 3 skipped
C:\quarantine\count.jar-15ba9547-775849cb.zip.Vir/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
C:\quarantine\count.jar-15ba9547-775849cb.zip.Vir/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
C:\quarantine\count.jar-15ba9547-775849cb.zip.Vir/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
C:\quarantine\count.jar-15ba9547-775849cb.zip.Vir ZIP: infected - 3 skipped
C:\quarantine\ie0601a[1].jar.Vir/Installer.class Infected: Trojan-Downloader.Java.OpenStream.z skipped
C:\quarantine\ie0601a[1].jar.Vir ZIP: infected - 1 skipped
C:\quarantine\ie0601a[1].jar.Vir.0/Installer.class Infected: Trojan-Downloader.Java.OpenStream.z skipped
C:\quarantine\ie0601a[1].jar.Vir.0 ZIP: infected - 1 skipped
C:\quarantine\jar[1].jar.Vir/Counter.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir/web.exe Infected: Trojan.Win32.LowZones.dp skipped
C:\quarantine\jar[1].jar.Vir/Worker.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir ZIP: infected - 5 skipped
C:\quarantine\jar[1].jar.Vir.0/Counter.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.0/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.0/web.exe Infected: Trojan-Downloader.Win32.Small.cpg skipped
C:\quarantine\jar[1].jar.Vir.0/Worker.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.0/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.0 ZIP: infected - 5 skipped
C:\quarantine\jar[1].jar.Vir.1/Counter.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.1/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.1/web.exe Infected: Trojan.Win32.LowZones.dp skipped
C:\quarantine\jar[1].jar.Vir.1/Worker.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.1/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.1 ZIP: infected - 5 skipped
C:\quarantine\jar[1].jar.Vir.2/Counter.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.2/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.2/web.exe Infected: Trojan.Win32.LowZones.dp skipped
C:\quarantine\jar[1].jar.Vir.2/Worker.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.2/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.2 ZIP: infected - 5 skipped
C:\quarantine\jar[1].jar.Vir.3/Counter.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.3/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.3/web.exe Infected: Trojan.Win32.LowZones.dp skipped
C:\quarantine\jar[1].jar.Vir.3/Worker.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.3/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.3 ZIP: infected - 5 skipped
C:\quarantine\jar[1].jar.Vir.4/Counter.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.4/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.4/web.exe Infected: Trojan-Downloader.Win32.Small.cpg skipped
C:\quarantine\jar[1].jar.Vir.4/Worker.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.4/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[1].jar.Vir.4 ZIP: infected - 5 skipped
C:\quarantine\jar[2].jar.Vir/Counter.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[2].jar.Vir/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[2].jar.Vir/web.exe Infected: Trojan-Downloader.Win32.Small.cpg skipped
C:\quarantine\jar[2].jar.Vir/Worker.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[2].jar.Vir/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\quarantine\jar[2].jar.Vir ZIP: infected - 5 skipped
C:\quarantine\joysaver[1].cab.Vir/mm83.ocx Infected: Trojan-Downloader.Win32.VB.ov skipped
C:\quarantine\joysaver[1].cab.Vir CAB: infected - 1 skipped
C:\quarantine\loaderadv585[1].jar.Vir/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\quarantine\loaderadv585[1].jar.Vir/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\quarantine\loaderadv585[1].jar.Vir/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\quarantine\loaderadv585[1].jar.Vir ZIP: infected - 3 skipped
C:\quarantine\loaderadv655[1].jar.Vir/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\quarantine\loaderadv655[1].jar.Vir/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\quarantine\loaderadv655[1].jar.Vir/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\quarantine\loaderadv655[1].jar.Vir ZIP: infected - 3 skipped
C:\quarantine\mseggo.gif Infected: Trojan-Spy.Win32.Delf.dx skipped
C:\quarantine\msnimk.gif Infected: not-a-virus:AdWare.Win32.Ipend skipped
C:\quarantine\New Folder\CollectedData_10407.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10437.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10455.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10467.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10486.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10488.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10490.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10492.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10494.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10496.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10497.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10498.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10500.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10502.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10504.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10506.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10508.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10510.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10512.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10514.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10515.xml Object is locked skipped
C:\quarantine\New Folder\dahotfix.log Object is locked skipped
C:\quarantine\New Folder\desktop.ini Object is locked skipped
C:\quarantine\New Folder\imsins.log Object is locked skipped
C:\quarantine\New Folder\KB887822.log Object is locked skipped
C:\quarantine\New Folder\msdfmap.ini Object is locked skipped
C:\quarantine\New Folder\ocgen.log Object is locked skipped
C:\quarantine\New Folder\ocmsn.log Object is locked skipped
C:\quarantine\New Folder\OEWABLog.txt Object is locked skipped
C:\quarantine\New Folder\PICTAKER.LOG Object is locked skipped
C:\quarantine\New Folder\River Sumida.bmp Object is locked skipped
C:\quarantine\poja.exe.Vir Infected: Backdoor.Win32.Padodor.ax skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP324\A0031939.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.g skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP338\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Downloaded Program Files\610651.exe Infected: Trojan.Win32.Diamin.ah skipped
C:\WINDOWS\Downloaded Program Files\actsetup.dll Infected: Trojan-Dropper.Win32.Agent.hn skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MARKETING10.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ3.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ6.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MediaPassX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\installer_MEDIAWHIZ3.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\installer_MEDIAWHIZ3.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\MediaPassX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\WINDOWS\Downloaded Program Files\sikogo.exe Infected: Trojan-Clicker.Win32.VB.pm skipped
C:\WINDOWS\Downloaded Program Files\USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\setup_silent_26223.exe/data0001 Infected: not-a-virus:AdWare.Win32.MDH.a skipped
C:\WINDOWS\setup_silent_26223.exe AWInstall: infected - 1 skipped
C:\WINDOWS\setup_silent_26223.exe UPX: infected - 1 skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\svrrunu.exe Infected: Trojan.Win32.Qrap skipped
C:\WINDOWS\system\UpdInst.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\WINDOWS\system32\AUNBHO.dll Infected: Trojan-Clicker.Win32.BHO.b skipped
C:\WINDOWS\system32\bap.exe Infected: not-a-virus:AdWare.Win32.WinAD skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\fozrcf.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\in10b6s.dll Infected: Trojan-Dropper.Win32.Mudrop.k skipped
C:\WINDOWS\system32\msehek.dll Infected: not-a-virus:AdWare.Win32.WebSearch.bb skipped
C:\WINDOWS\system32\msiaih.dll Infected: not-a-virus:AdWare.Win32.Ipend skipped
C:\WINDOWS\system32\rυndll32.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\WINDOWS\system32\SWRT01.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped
C:\WINDOWS\system32\toolbar.exe/CommunicatorSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\WINDOWS\system32\toolbar.exe/QLSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\WINDOWS\system32\toolbar.exe StarDust: infected - 2 skipped
C:\WINDOWS\system32\tаskmgr.exe Infected: not-a-virus:AdWare.Win32.PurityScan.aa skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wobugf.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 9:37:02 PM, on 2/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Desktop Stuff\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PID41IER.exe ] C:\WINDOWS\system32\PID41IER.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: KATRACK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

HIJACKTHIS LOG:

Logfile of HijackThis v1.99.1
Scan saved at 8:24:22 PM, on 2/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Desktop Stuff\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PID41IER.exe ] C:\WINDOWS\system32\PID41IER.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by103fd.bay103.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: KATRACK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

KASPERSKY REPORT

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Thursday, February 15, 2007 8:21:52 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 16/02/2007
Kaspersky Anti-Virus database records: 268399
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 43662
Number of viruses found: 23
Number of infected objects: 37 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:30:07

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\Agent_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\PrdMgr_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\Aim\fs17dbc\cert8.db Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Application Data\Aim\fs17dbc\key3.db Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\Perflib_Perfdata_77c.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF3DAF.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DFAFF9.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DFB014.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DFE48C.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DFE4A7.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Excel\Feb12.xls Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat.LOG Object is locked skipped
C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream.a skipped
C:\Program Files\ProcManager.exe Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\quarantine\arr3[1].jar.Vir Object is locked skipped
C:\quarantine\count.jar-15ba9547-775849cb.zip.Vir Object is locked skipped
C:\quarantine\ie0601a[1].jar.Vir Object is locked skipped
C:\quarantine\ie0601a[1].jar.Vir.0 Object is locked skipped
C:\quarantine\jar[1].jar.Vir Object is locked skipped
C:\quarantine\jar[1].jar.Vir.0 Object is locked skipped
C:\quarantine\jar[1].jar.Vir.1 Object is locked skipped
C:\quarantine\jar[1].jar.Vir.2 Object is locked skipped
C:\quarantine\jar[1].jar.Vir.3 Object is locked skipped
C:\quarantine\jar[1].jar.Vir.4 Object is locked skipped
C:\quarantine\jar[2].jar.Vir Object is locked skipped
C:\quarantine\joysaver[1].cab.Vir Object is locked skipped
C:\quarantine\loaderadv585[1].jar.Vir Object is locked skipped
C:\quarantine\loaderadv655[1].jar.Vir Object is locked skipped
C:\quarantine\New Folder\CollectedData_10407.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10437.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10455.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10467.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10486.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10488.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10490.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10492.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10494.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10496.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10497.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10498.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10500.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10502.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10504.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10506.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10508.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10510.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10512.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10514.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10515.xml Object is locked skipped
C:\quarantine\New Folder\dahotfix.log Object is locked skipped
C:\quarantine\New Folder\desktop.ini Object is locked skipped
C:\quarantine\New Folder\imsins.log Object is locked skipped
C:\quarantine\New Folder\KB887822.log Object is locked skipped
C:\quarantine\New Folder\msdfmap.ini Object is locked skipped
C:\quarantine\New Folder\ocgen.log Object is locked skipped
C:\quarantine\New Folder\ocmsn.log Object is locked skipped
C:\quarantine\New Folder\OEWABLog.txt Object is locked skipped
C:\quarantine\New Folder\PICTAKER.LOG Object is locked skipped
C:\quarantine\New Folder\River Sumida.bmp Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033277.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.Searcher.h skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0007.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe WiseSFX: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033279.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe/data0001 Infected: not-a-virus:AdWare.Win32.MDH.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe AWInstall: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033281.exe Infected: Trojan.Win32.Qrap skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033282.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033283.dll Infected: Trojan-Clicker.Win32.BHO.b skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033284.exe Infected: not-a-virus:AdWare.Win32.WinAD skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033285.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033286.dll Infected: Trojan-Dropper.Win32.Mudrop.k skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033287.dll Infected: not-a-virus:AdWare.Win32.WebSearch.bb skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033288.dll Infected: not-a-virus:AdWare.Win32.Ipend skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033289.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/CommunicatorSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/QLSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe StarDust: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033291.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Downloaded Program Files\610651.exe Infected: Trojan.Win32.Diamin.ah skipped
C:\WINDOWS\Downloaded Program Files\actsetup.dll Infected: Trojan-Dropper.Win32.Agent.hn skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MARKETING10.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ3.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ6.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MediaPassX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\installer_MEDIAWHIZ3.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\installer_MEDIAWHIZ3.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\WINDOWS\Downloaded Program Files\MediaPassX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\WINDOWS\Downloaded Program Files\sikogo.exe Infected: Trojan-Clicker.Win32.VB.pm skipped
C:\WINDOWS\Downloaded Program Files\USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\rυndll32.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\WINDOWS\system32\tаskmgr.exe Infected: not-a-virus:AdWare.Win32.PurityScan.aa skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

FILES.TXT

Volume in drive C has no label.
Volume Serial Number is B0B0-941D

Directory of c:\WINDOWS\system32

08/03/2004 11:56 PM 135,680 taskmgr.exe
10/05/2004 10:06 AM 380,928 t?skmgr.exe
2 File(s) 516,608 bytes

Directory of C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Desktop