What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

ads.k8l.info (cont.)

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi That bat file thing didn't went ok, so we'll try again: Launch Notepad, and copy/paste the box below into a new text file. Save it as FindFile2.bat (save it as all files, *.*) and save it on your Desktop. dir c:\WINDOWS\system32\r?ndll32.exe /a h > file.txt notepad file.txt Locate FindFile2.bat on your Desktop and double-click on it. It will open Notepad with some text in it. Please post the text here
Post #17
Volume in drive C has no label. Volume Serial Number is B0B0-941D Directory of c:\WINDOWS\system32 08/03/2004 11:56 PM 33,280 rundll32.exe 09/08/2004 12:36 PM 372,736 r?ndll32.exe 2 File(s) 406,016 bytes Directory of C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Desktop
Post #18
Hi

Go to C:\windows\system32 directory

You should see there two files like rundll32.exe. Delete that one with following details:

09/08/2004 12:36 PM 372,736

Don't delete this!

08/03/2004 11:56 PM 33,280

Next find taskmgr.exe, there should be two of them

Delete that one with following details:

10/05/2004 10:06 AM 380,928

Don't delete this!

08/03/2004 11:56 PM 135,680

Launch Notepad, and copy/paste the box below into a new text file. Save it as remquar.bat (save it as all files, *.*) and save it on your Desktop.

attrib -r -h C:\quarantine\*.*
del /a /f /q C:\quarantine\*.*
attrib -r -h C:\quarantine\New Folder\*.*
del /a /f /q C:\quarantine\New Folder\*.*

Locate remquar.bat on your Desktop and double-click on it. Black dos window will flash, it's ok

Please download the Killbox.
Unzip it to the desktop.

Please run Killbox.

Select "Delete on Reboot" and "All files"

Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\Downloaded Program Files\610651.exe
C:\WINDOWS\Downloaded Program Files\actsetup.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MARKETING10.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ3.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ6.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MediaPassX.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\USDR6_0001_D08M0404NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\installer_MEDIAWHIZ3.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\installer_MEDIAWHIZ3.exe
C:\WINDOWS\Downloaded Program Files\MediaPassX.dll
C:\WINDOWS\Downloaded Program Files\sikogo.exe
C:\WINDOWS\Downloaded Program Files\USDR6_0001_D08M0404NetInstaller.exe

Go to the File menu, and choose "Paste from Clipboard".

Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

If your computer does not restart automatically, please restart it manually.4

Re-scan with kaspersky

Send:

- a fresh HijackThis log
- kaspersky report
Post #19
I'm not exactly sure what you mean by "directory", although I assume it jsut means to go into that folder. I went into the folder C:\Windows\system32 and none of those files are there. What am I doing wrong?
Post #21
OK so I did everything I could to show all of the files. In the folder there are the following files: "rundll32" file that is an Application and says "Run DLL as an App" - 32.5 kb - created: 10/22/04 "rundll32" file that is an Application - 364 kb - created: 9/10/04 "taskman" file that is an Application - 15 kb - created: 8/30/2001 "taskmgr" file that is an Application - 132 kb - created: 10/22/04 I'm not sure which ones to delete. Those are the only files in that folder with similiar names.
Post #23
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Friday, February 23, 2007 5:19:05 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 23/02/2007
Kaspersky Anti-Virus database records: 272967
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 45984
Number of viruses found: 23
Number of infected objects: 38 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:23:13

Infected Object Name / Virus Name / Last Action
C:\!KillBox\610651.exe Infected: Trojan.Win32.Diamin.ah skipped
C:\!KillBox\actsetup.dll Infected: Trojan-Dropper.Win32.Agent.hn skipped
C:\!KillBox\installer_MARKETING10.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\!KillBox\installer_MEDIAWHIZ3.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\!KillBox\installer_MEDIAWHIZ3.exe( 1) Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\!KillBox\installer_MEDIAWHIZ3.exe( 4) Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\!KillBox\installer_MEDIAWHIZ6.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\!KillBox\MediaPassX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\!KillBox\MediaPassX.dll( 3) Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\!KillBox\sikogo.exe Infected: Trojan-Clicker.Win32.VB.pm skipped
C:\!KillBox\USDR6_0001_D08M0404NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\!KillBox\USDR6_0001_D08M0404NetInstaller.exe( 2) Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\Agent_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\PrdMgr_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\fla1C3.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF1260.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF1272.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF5858.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF6243.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Excel\Feb19.xls Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Excel\Feb26.xls Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat.LOG Object is locked skipped
C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream.a skipped
C:\Program Files\ProcManager.exe Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\quarantine\New Folder\CollectedData_10407.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10437.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10455.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10467.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10486.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10488.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10490.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10492.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10494.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10496.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10497.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10498.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10500.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10502.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10504.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10506.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10508.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10510.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10512.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10514.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10515.xml Object is locked skipped
C:\quarantine\New Folder\dahotfix.log Object is locked skipped
C:\quarantine\New Folder\desktop.ini Object is locked skipped
C:\quarantine\New Folder\imsins.log Object is locked skipped
C:\quarantine\New Folder\KB887822.log Object is locked skipped
C:\quarantine\New Folder\msdfmap.ini Object is locked skipped
C:\quarantine\New Folder\ocgen.log Object is locked skipped
C:\quarantine\New Folder\ocmsn.log Object is locked skipped
C:\quarantine\New Folder\OEWABLog.txt Object is locked skipped
C:\quarantine\New Folder\PICTAKER.LOG Object is locked skipped
C:\quarantine\New Folder\River Sumida.bmp Object is locked skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc323.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033277.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.Searcher.h skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0007.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe WiseSFX: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033279.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe/data0001 Infected: not-a-virus:AdWare.Win32.MDH.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe AWInstall: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033281.exe Infected: Trojan.Win32.Qrap skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033282.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033283.dll Infected: Trojan-Clicker.Win32.BHO.b skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033284.exe Infected: not-a-virus:AdWare.Win32.WinAD skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033285.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033286.dll Infected: Trojan-Dropper.Win32.Mudrop.k skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033287.dll Infected: not-a-virus:AdWare.Win32.WebSearch.bb skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033288.dll Infected: not-a-virus:AdWare.Win32.Ipend skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033289.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/CommunicatorSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/QLSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe StarDust: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033291.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP354\A0034071.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP357\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{505D9F9C-B0AF-400C-8789-113E4F3EF6BD}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\tаskmgr.exe Infected: not-a-virus:AdWare.Win32.PurityScan.aa skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 5:33:43 PM, on 2/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Desktop Stuff\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PID41IER.exe ] C:\WINDOWS\system32\PID41IER.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by103fd.bay103.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: KATRACK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
Post #24
Hi Empty this folder: C:\!KillBox\ Empty Recycle Bin Take a look at system32 folder again, please. There should be these: Directory of c:\WINDOWS\system32 08/03/2004 11:56 PM 135,680 taskmgr.exe 10/05/2004 10:06 AM 380,928 t?skmgr.exe You already found that 135.680, which is a legit taskmgr.exe That with 380,928 might have some other second character than a, anyway rest of name is t_skmgr.exe Re-scan with kaspersky Send: - a fresh HijackThis log - kaspersky report
Post #25
Logfile of HijackThis v1.99.1
Scan saved at 3:20:00 PM, on 2/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Desktop Stuff\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PID41IER.exe ] C:\WINDOWS\system32\PID41IER.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by103fd.bay103.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: KATRACK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe



——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, February 28, 2007 3:18:02 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 28/02/2007
Kaspersky Anti-Virus database records: 274740
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 45279
Number of viruses found: 24
Number of infected objects: 48 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:17:39

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\Agent_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\PrdMgr_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF59BC.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DFF43E.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DFF459.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\6B7D9YIJ\KPSS-468x60[1].swf Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7KXFARHK\847[2].zip/images/top_avi.exe Infected: Trojan.Win32.Dialer.nv skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7KXFARHK\847[2].zip/filmato.mpeg.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7KXFARHK\847[2].zip/Codec.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7KXFARHK\847[2].zip ZIP: infected - 3 skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7ST0U6G1\855[1].zip/images/top_avi.exe Infected: Trojan.Win32.Dialer.nv skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7ST0U6G1\855[1].zip/filmato.mpeg.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7ST0U6G1\855[1].zip/Codec.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7ST0U6G1\855[1].zip ZIP: infected - 3 skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Excel\Feb26.xls Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat.LOG Object is locked skipped
C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream.a skipped
C:\Program Files\ProcManager.exe Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\quarantine\New Folder\CollectedData_10407.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10437.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10455.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10467.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10486.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10488.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10490.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10492.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10494.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10496.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10497.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10498.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10500.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10502.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10504.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10506.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10508.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10510.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10512.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10514.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10515.xml Object is locked skipped
C:\quarantine\New Folder\dahotfix.log Object is locked skipped
C:\quarantine\New Folder\desktop.ini Object is locked skipped
C:\quarantine\New Folder\imsins.log Object is locked skipped
C:\quarantine\New Folder\KB887822.log Object is locked skipped
C:\quarantine\New Folder\msdfmap.ini Object is locked skipped
C:\quarantine\New Folder\ocgen.log Object is locked skipped
C:\quarantine\New Folder\ocmsn.log Object is locked skipped
C:\quarantine\New Folder\OEWABLog.txt Object is locked skipped
C:\quarantine\New Folder\PICTAKER.LOG Object is locked skipped
C:\quarantine\New Folder\River Sumida.bmp Object is locked skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc14.exe Infected: Trojan.Win32.Diamin.ah skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc15.dll Infected: Trojan-Dropper.Win32.Agent.hn skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc16.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc17.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc18 Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc19 Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc20.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc21.dll Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc22 Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc23.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc24 Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\RECYCLER\S-1-5-21-1229272821-1383384898-839522115-1003\Dc28.exe Infected: not-a-virus:AdWare.Win32.PurityScan.aa skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033277.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.Searcher.h skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0007.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe WiseSFX: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033279.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe/data0001 Infected: not-a-virus:AdWare.Win32.MDH.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe AWInstall: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033281.exe Infected: Trojan.Win32.Qrap skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033282.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033283.dll Infected: Trojan-Clicker.Win32.BHO.b skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033284.exe Infected: not-a-virus:AdWare.Win32.WinAD skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033285.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033286.dll Infected: Trojan-Dropper.Win32.Mudrop.k skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033287.dll Infected: not-a-virus:AdWare.Win32.WebSearch.bb skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033288.dll Infected: not-a-virus:AdWare.Win32.Ipend skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033289.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/CommunicatorSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/QLSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe StarDust: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033291.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP354\A0034071.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP357\A0034276.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP359\A0034362.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP359\A0034363.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP359\A0034424.exe Infected: Trojan.Win32.Dialer.nv skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{E31287B6-2295-4898-BCE3-7089C3DC1404}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.
Post #26
Hi

Please run Killbox.

Select "Delete on Reboot" and "All files"

Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7KXFARHK\847[2].zip
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\7ST0U6G1\855[1].zip

Go to the File menu, and choose "Paste from Clipboard".

Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

If your computer does not restart automatically, please restart it manually.

Empty this folder:

C:\!Killbox

Empty Recycle Bin

Re-scan with kaspersky

Post:

- a fresh HijackThis log
- kaspersky report
Post #27
I've tried running Killbox a number of times but I keep getting the same message: "PendingFileRenameOperations Registry Data has been Removed by External Process!"
Post #29
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Thursday, March 08, 2007 9:50:01 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 9/03/2007
Kaspersky Anti-Virus database records: 279301
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 45753
Number of viruses found: 24
Number of infected objects: 36 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:08:31

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\Agent_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\PrdMgr_DEREK-9DKB5EPJ1.log Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\History\History.IE5\MSHist012007030820070309\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF4520.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temp\~DF452D.tmp Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat Object is locked skipped
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\ntuser.dat.LOG Object is locked skipped
C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream.a skipped
C:\Program Files\ProcManager.exe Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\quarantine\New Folder\CollectedData_10407.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10437.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10455.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10467.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10486.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10488.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10490.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10492.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10494.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10496.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10497.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10498.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10500.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10502.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10504.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10506.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10508.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10510.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10512.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10514.xml Object is locked skipped
C:\quarantine\New Folder\CollectedData_10515.xml Object is locked skipped
C:\quarantine\New Folder\dahotfix.log Object is locked skipped
C:\quarantine\New Folder\desktop.ini Object is locked skipped
C:\quarantine\New Folder\imsins.log Object is locked skipped
C:\quarantine\New Folder\KB887822.log Object is locked skipped
C:\quarantine\New Folder\msdfmap.ini Object is locked skipped
C:\quarantine\New Folder\ocgen.log Object is locked skipped
C:\quarantine\New Folder\ocmsn.log Object is locked skipped
C:\quarantine\New Folder\OEWABLog.txt Object is locked skipped
C:\quarantine\New Folder\PICTAKER.LOG Object is locked skipped
C:\quarantine\New Folder\River Sumida.bmp Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033277.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.Searcher.h skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe/WISE0007.BIN Infected: not-a-virus:RiskTool.Win32.PsKill.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033278.exe WiseSFX: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033279.exe Infected: not-a-virus:AdWare.Win32.DelphinMediaViewer.f skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe/data0001 Infected: not-a-virus:AdWare.Win32.MDH.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe AWInstall: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033280.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033281.exe Infected: Trojan.Win32.Qrap skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033282.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033283.dll Infected: Trojan-Clicker.Win32.BHO.b skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033284.exe Infected: not-a-virus:AdWare.Win32.WinAD skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033285.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033286.dll Infected: Trojan-Dropper.Win32.Mudrop.k skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033287.dll Infected: not-a-virus:AdWare.Win32.WebSearch.bb skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033288.dll Infected: not-a-virus:AdWare.Win32.Ipend skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033289.dll Infected: not-a-virus:AdWare.Win32.VirtualBouncer.g skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/CommunicatorSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe/QLSetup.exe Infected: not-a-virus:AdWare.Win32.MDH.e skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033290.exe StarDust: infected - 2 skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP348\A0033291.exe Infected: not-a-virus:AdWare.Win32.Adstart.d skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP354\A0034071.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP357\A0034276.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP359\A0034362.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP359\A0034363.exe Infected: Trojan.Win32.Dialer.hh skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP359\A0034424.exe Infected: Trojan.Win32.Dialer.nv skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034597.exe Infected: Trojan.Win32.Diamin.ah skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034598.dll Infected: Trojan-Dropper.Win32.Agent.hn skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034599.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034600.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034601.exe Infected: Trojan-Downloader.Win32.Adload.a skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034602.dll Infected: not-a-virus:AdWare.Win32.WinAD.ad skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034603.exe Infected: not-a-virus:Downloader.Win32.WinFixer.l skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP362\A0034604.exe Infected: not-a-virus:AdWare.Win32.PurityScan.aa skipped
C:\System Volume Information\_restore{5B23240F-281B-48DF-93CA-585D00E961FB}\RP370\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 10:02:58 PM, on 3/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Documents and Settings\Owner.DEREK-9DKB5EPJ1\My Documents\Desktop Stuff\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PID41IER.exe ] C:\WINDOWS\system32\PID41IER.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by103fd.bay103.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: KATRACK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
Post #30
Hi Logs look good. All viruses are in system restore which can be easily cleaned according to instructions I give you later Other than that, how are things running now?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI