My HijackThis Log..Need Help Please.

Hi Parth,

I'm Gary R, I'll be glad to help you with your computer problems.

As an introduction, please note I don't know everything, what I do know has taken me years to learn and I'm happy to pass on this information to you, but bear in mind that I'm also fallible. I do have a very knowlegable group behind me who I can ask if needs be.

Please observe these rules while we work:

• Perform all actions in the order given.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with it till you're given the all clear.
• Remember, absence of symptoms does not mean the infection is all gone.

If you can do these things, everything should go smoothly.

• Please note you'll need to have Administrator priviledges to perform the fixes. (XP accounts are Administrator by default)

You appear to have one of the Vundo varients, this one hides from HijackThis, so it is necessary to re-name it so we can see what's being hidden.

• Go to C:\hijackthis
• Rename HijackThis.exe to FredFlintstone.exe
• Run a new scan with HJT (FredFlintstone) and send me the new log please.

Hi Parth,

Please don't try to PM me things, post all replies back in this thread.

OK, we can see things a little better now, though I'm not seeing quite what I expected to (could be a new variant).

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix will encounter a file it can't remove. In this case, VundoFix will run on reboot. Simply follow the above instructions starting from Click the Scan for Vundo button when VundoFix appears at reboot.

Please do an online scan with Kaspersky Online Scanner

Note: You must be using Internet Explorer as your browser as it will be necessary to install an Active X component to your computer.

Important If you have previously used Kaspersky Online Scanner (before 8th Aug 2006), you will have to uninstall the old version using Add/Remove Programs in Control Panel before you can use the new version.

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings.
• In the scan settings make sure that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK.
• Now under select a target to scan select My Computer.
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

Note: The Kaspersky online scanner is not yet fully compatible with IE7. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.

Now can you send me the following logs please:

• Kaspersky log
• log created by Vundofix, this is in this location C:\Vundofix.txt
• New HJT log

Post each log separately, as sometimes the kaspersky log can be quite long, and we don't want it to get cut off by the forum post size limiter.

KASPERSKY LOG…. ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Saturday, February 17, 2007 11:47:34 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 17/02/2007 Kaspersky Anti-Virus database records: 269086 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 75659 Number of viruses found: 18 Number of infected objects: 218 / 0 Number of suspicious objects: 0 Duration of the scan process: 00:58:47 Infected Object Name / Virus Name / Last Action C:\CCProxy\CDial.dll Infected: not-a-virus:Server-Proxy.Win32.CCProxy.63 skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_5b150187-0f05-4c72-917c-77c8e6964ac4 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\bmcchdxc.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\bwyaqycs.dll.bac_a02664 Infected: Trojan.Win32.BHO.g skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ctwvcwld.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\DP.sys.bac_a02664 Infected: Trojan.Win32.Agent.ny skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\dxrguyno.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ekcsytqx.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\epljcndp.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\fofxlqpp.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\glecqble.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\hbglncxf.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\hgquaute.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\hswlxekn.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ibniduks.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ihjlhsrs.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ixchqnon.exe.bac_a02664 Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\jigsbiqd.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\jimbdelq.dll.bac_a02664 Infected: Trojan.Win32.BHO.g skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ldbgbvts.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\lwheqnnu.dll.bac_a02664 Infected: Trojan.Win32.BHO.o skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\mykibodi.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\nmpfsdlr.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\oobcwjkm.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\osrqngww.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\pccdrcto.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\qeydcpvt.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\rscshdje.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\smaggblb.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ssshstuq.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\vhuiftgi.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\vtnmmojf.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-37d0245a-6db441da.class Infected: Trojan-Downloader.Java.OpenStream.y skipped C:\Documents and Settings\Parthiv\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\History\History.IE5\MSHist012007021720070218\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\ICD1.tmp\UWA7P_0001_N91M0809NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\~DFD2FF.tmp Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Parthiv\ntuser.dat.LOG Object is locked skipped C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream skipped C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll Infected: not-a-virus:AdWare.Win32.MyWay.v skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066825.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066826.exe Infected: Trojan.Win32.Small.ju skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066827.exe Infected: Trojan.Win32.Small.ju skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066828.exe Infected: Trojan.Win32.Small.ju skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066829.exe Infected: Trojan.Win32.Small.ju skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066830.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066831.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066832.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066833.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066834.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066835.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066836.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066837.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066838.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066839.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066840.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066841.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066842.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066843.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066844.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066845.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066846.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066847.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066848.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066849.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066850.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066851.sys Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066852.dll Infected: Trojan.Win32.BHO.o skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066853.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066854.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP601\A0074337.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP602\A0074555.dll Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP602\A0074556.dll Infected: not-a-virus:AdWare.Win32.Webdir.b skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075613.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075614.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075615.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075616.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075617.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075618.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075619.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075620.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075621.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075622.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075623.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075624.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075625.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075626.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075627.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075628.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075629.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075630.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075631.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075632.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075633.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075634.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075635.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075636.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075637.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075638.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075639.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075640.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075642.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075644.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075645.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075646.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075647.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075648.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075649.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075650.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075651.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075652.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075653.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075654.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075655.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075656.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075657.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075658.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075659.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075660.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075661.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075662.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075663.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075664.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075665.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075666.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075667.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075668.dll Infected: Packed.Win32.Klone.k skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075669.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075670.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075671.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075672.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075673.dll Infected: Trojan-Spy.Win32.VBStat.e skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075674.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\change.log Object is locked skipped C:\VundoFix Backups\aarcrkhm.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\aggmsppp.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\alhheuif.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\bkvrodih.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\bmtkbogn.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\ciutgecs.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\crpmevws.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\dcdqcnvk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\VundoFix Backups\dffctpym.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\dnkefhfg.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\drgxigtl.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\dvamenrj.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\ektcburf.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\eoleqipm.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\eyjkomlp.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\fcgylcgf.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\fcwlvvnt.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\hbklwruk.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\hcspgnsh.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\hmkmackp.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\hnvndcde.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\hsewidtp.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\huaqwsws.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\hudpvrpd.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\iaumoqsw.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\iifeecma.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\ikaoibkj.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\VundoFix Backups\iyideueb.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\jvivdctd.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\lvngggha.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\lxmrpnib.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\mdvcorni.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\mkevvqtv.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\naeepujb.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\ofxmgjwc.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\oksqmmuk.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\opxvynqx.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\oxtixqht.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\pacmpmbi.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\pkrqixms.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\rgqlwwsm.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\rsjotdrd.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\rtlkniaw.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\sgbjfksj.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\svyjkoxg.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\sxmmluul.exe.bad Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\VundoFix Backups\tnjjlyrr.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\tnwxhjok.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\tqjcgqht.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\uvoaajrr.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\vrijkklm.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\vsskbrvg.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\vylsoouw.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\wayylfsw.dll.bad Infected: Packed.Win32.Klone.k skipped C:\VundoFix Backups\weapkcky.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\xfxalatg.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\xqtogqtg.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\xxkdrxhp.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\yjisepnt.dll.bad Infected: Trojan-Spy.Win32.VBStat.e skipped C:\VundoFix Backups\yuxflcxu.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\WINDOWS\ModemLog_Conexant D110 MDC V.9x Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{8534E2D3-D6F5-467D-9FF7-8AB0F39F32AD}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\abesrcen.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\afwdeebn.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\WINDOWS\system32\btqwqdgt.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\btuierje.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\crjgqdgu.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\cspqggfl.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\cxroukkb.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\fdhxbgmp.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\fndsncvo.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\hkobrrfn.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\inssiilq.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\kfrrgmvw.dll Infected: Trojan-Spy.Win32.Agent.ps skipped C:\WINDOWS\system32\ldqbxpfs.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\lnebcbet.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\mllhotpm.dll Infected: Trojan.Win32.BHO.g skipped C:\WINDOWS\system32\mpgmwjry.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\nnaholsj.dll Infected: Trojan.Win32.BHO.g skipped C:\WINDOWS\system32\oacqpmdu.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\WINDOWS\system32\pfbypfai.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\WINDOWS\system32\pfdxiscb.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\pucapfek.dll Infected: Trojan.Win32.BHO.g skipped C:\WINDOWS\system32\qolepylj.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\WINDOWS\system32\rpcxhqkk.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\sjthitvd.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\ublmfwoc.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\uygftijg.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\vtgclscd.dll Infected: Packed.Win32.Klone.j skipped C:\WINDOWS\system32\vtkwfadj.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\xliadvty.exe Infected: Trojan.Win32.Agent.ny skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

VUNDO LOG… VundoFix V6.3.6 Checking Java version… Java version is 1.4.2.3 Java version is 1.5.0.3 Scan started at 7:09:36 PM 2/16/2007 Listing files found while scanning…. C:\WINDOWS\system32\aarcrkhm.dll C:\WINDOWS\system32\aggmsppp.dll C:\WINDOWS\system32\alhheuif.dll C:\WINDOWS\system32\bkvrodih.dll C:\WINDOWS\system32\bmtkbogn.dll C:\WINDOWS\system32\ciutgecs.dll C:\WINDOWS\system32\crpmevws.dll C:\WINDOWS\system32\dcdqcnvk.dll C:\WINDOWS\system32\dffctpym.dll C:\WINDOWS\system32\dnkefhfg.dll C:\WINDOWS\system32\drgxigtl.dll C:\WINDOWS\system32\dvamenrj.dll C:\WINDOWS\system32\ektcburf.dll C:\WINDOWS\system32\eoleqipm.dll C:\WINDOWS\system32\eyjkomlp.dll C:\WINDOWS\system32\fcgylcgf.dll C:\WINDOWS\system32\fcwlvvnt.dll C:\WINDOWS\system32\hbklwruk.dll C:\WINDOWS\system32\hcspgnsh.dll C:\WINDOWS\system32\hmkmackp.dll C:\WINDOWS\system32\hnvndcde.dll C:\WINDOWS\system32\hsewidtp.dll C:\WINDOWS\system32\huaqwsws.dll C:\WINDOWS\system32\hudpvrpd.dll C:\WINDOWS\system32\iaumoqsw.dll C:\WINDOWS\system32\iifeecma.dll C:\WINDOWS\system32\ikaoibkj.dll C:\WINDOWS\system32\iyideueb.dll C:\WINDOWS\system32\jkbioaki.ini C:\WINDOWS\system32\jvivdctd.dll C:\WINDOWS\system32\kavnlsdw.exe C:\WINDOWS\system32\kvncqdcd.ini C:\WINDOWS\system32\lvngggha.dll C:\WINDOWS\system32\lxmrpnib.dll C:\WINDOWS\system32\mdvcorni.dll C:\WINDOWS\system32\mkevvqtv.dll C:\WINDOWS\system32\naeepujb.dll C:\WINDOWS\system32\ofxmgjwc.dll C:\WINDOWS\system32\oksqmmuk.dll C:\WINDOWS\system32\opxvynqx.dll C:\WINDOWS\system32\oxtixqht.dll C:\WINDOWS\system32\pacmpmbi.dll C:\WINDOWS\system32\pkrqixms.dll C:\WINDOWS\system32\rgqlwwsm.dll C:\WINDOWS\system32\rsjotdrd.dll C:\WINDOWS\system32\rtlkniaw.dll C:\WINDOWS\system32\sgbjfksj.dll C:\WINDOWS\system32\svyjkoxg.dll C:\WINDOWS\system32\sxmmluul.exe C:\WINDOWS\system32\tnjjlyrr.dll C:\WINDOWS\system32\tnwxhjok.dll C:\WINDOWS\system32\tqjcgqht.dll C:\WINDOWS\system32\uvoaajrr.dll C:\WINDOWS\system32\vrijkklm.dll C:\WINDOWS\system32\vsskbrvg.dll C:\WINDOWS\system32\vylsoouw.dll C:\WINDOWS\system32\wayylfsw.dll C:\WINDOWS\system32\weapkcky.dll C:\WINDOWS\system32\xfxalatg.dll C:\WINDOWS\system32\xqtogqtg.dll C:\WINDOWS\system32\xxkdrxhp.dll C:\WINDOWS\system32\yjisepnt.dll C:\WINDOWS\system32\yuxflcxu.dll Beginning removal… Attempting to delete C:\WINDOWS\system32\aarcrkhm.dll C:\WINDOWS\system32\aarcrkhm.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\aggmsppp.dll C:\WINDOWS\system32\aggmsppp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\alhheuif.dll C:\WINDOWS\system32\alhheuif.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\bkvrodih.dll C:\WINDOWS\system32\bkvrodih.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\bmtkbogn.dll C:\WINDOWS\system32\bmtkbogn.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ciutgecs.dll C:\WINDOWS\system32\ciutgecs.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\crpmevws.dll C:\WINDOWS\system32\crpmevws.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\dcdqcnvk.dll C:\WINDOWS\system32\dcdqcnvk.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\dffctpym.dll C:\WINDOWS\system32\dffctpym.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\dnkefhfg.dll C:\WINDOWS\system32\dnkefhfg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\drgxigtl.dll C:\WINDOWS\system32\drgxigtl.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\dvamenrj.dll C:\WINDOWS\system32\dvamenrj.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ektcburf.dll C:\WINDOWS\system32\ektcburf.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\eoleqipm.dll C:\WINDOWS\system32\eoleqipm.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\eyjkomlp.dll C:\WINDOWS\system32\eyjkomlp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\fcgylcgf.dll C:\WINDOWS\system32\fcgylcgf.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\fcwlvvnt.dll C:\WINDOWS\system32\fcwlvvnt.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hbklwruk.dll C:\WINDOWS\system32\hbklwruk.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hcspgnsh.dll C:\WINDOWS\system32\hcspgnsh.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hmkmackp.dll C:\WINDOWS\system32\hmkmackp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hnvndcde.dll C:\WINDOWS\system32\hnvndcde.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hsewidtp.dll C:\WINDOWS\system32\hsewidtp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\huaqwsws.dll C:\WINDOWS\system32\huaqwsws.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hudpvrpd.dll C:\WINDOWS\system32\hudpvrpd.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\iaumoqsw.dll C:\WINDOWS\system32\iaumoqsw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\iifeecma.dll C:\WINDOWS\system32\iifeecma.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ikaoibkj.dll C:\WINDOWS\system32\ikaoibkj.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\iyideueb.dll C:\WINDOWS\system32\iyideueb.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\jkbioaki.ini C:\WINDOWS\system32\jkbioaki.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\jvivdctd.dll C:\WINDOWS\system32\jvivdctd.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\kavnlsdw.exe C:\WINDOWS\system32\kavnlsdw.exe Has been deleted! Attempting to delete C:\WINDOWS\system32\kvncqdcd.ini C:\WINDOWS\system32\kvncqdcd.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\lvngggha.dll C:\WINDOWS\system32\lvngggha.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\lxmrpnib.dll C:\WINDOWS\system32\lxmrpnib.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mdvcorni.dll C:\WINDOWS\system32\mdvcorni.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mkevvqtv.dll C:\WINDOWS\system32\mkevvqtv.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\naeepujb.dll C:\WINDOWS\system32\naeepujb.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ofxmgjwc.dll C:\WINDOWS\system32\ofxmgjwc.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\oksqmmuk.dll C:\WINDOWS\system32\oksqmmuk.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\opxvynqx.dll C:\WINDOWS\system32\opxvynqx.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\oxtixqht.dll C:\WINDOWS\system32\oxtixqht.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\pacmpmbi.dll C:\WINDOWS\system32\pacmpmbi.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\pkrqixms.dll C:\WINDOWS\system32\pkrqixms.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\rgqlwwsm.dll C:\WINDOWS\system32\rgqlwwsm.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\rsjotdrd.dll C:\WINDOWS\system32\rsjotdrd.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\rtlkniaw.dll C:\WINDOWS\system32\rtlkniaw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\sgbjfksj.dll C:\WINDOWS\system32\sgbjfksj.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\svyjkoxg.dll C:\WINDOWS\system32\svyjkoxg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\sxmmluul.exe C:\WINDOWS\system32\sxmmluul.exe Has been deleted! Attempting to delete C:\WINDOWS\system32\tnjjlyrr.dll C:\WINDOWS\system32\tnjjlyrr.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\tnwxhjok.dll C:\WINDOWS\system32\tnwxhjok.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\tqjcgqht.dll C:\WINDOWS\system32\tqjcgqht.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\uvoaajrr.dll C:\WINDOWS\system32\uvoaajrr.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\vrijkklm.dll C:\WINDOWS\system32\vrijkklm.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\vsskbrvg.dll C:\WINDOWS\system32\vsskbrvg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\vylsoouw.dll C:\WINDOWS\system32\vylsoouw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\wayylfsw.dll C:\WINDOWS\system32\wayylfsw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\weapkcky.dll C:\WINDOWS\system32\weapkcky.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\xfxalatg.dll C:\WINDOWS\system32\xfxalatg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\xqtogqtg.dll C:\WINDOWS\system32\xqtogqtg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\xxkdrxhp.dll C:\WINDOWS\system32\xxkdrxhp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\yjisepnt.dll C:\WINDOWS\system32\yjisepnt.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\yuxflcxu.dll C:\WINDOWS\system32\yuxflcxu.dll Has been deleted! Performing Repairs to the registry. Done!

Hi Parth,

Looks like we've only got part of the infection, quite a way to go yet.

Download Pocket Killbox and install it to your Desktop. Do not run it yet.

Download ATF Cleaner by Atribune and save it to your Desktop. Do not run it yet.

Download AVG Anti-Spyware.

• Install AVG Anti-Spyware.
• Launch AVG by double-clicking on the icon.
• The program will now open to the main screen.
• You will need to update AVG to the latest definition files.
• At the top of the main screen click Update.
• Then in the Manual Update section, click on Start Update.

[*]The update will start and a progress bar will show the updates being installed.

[*]When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.
AVG manual updates

Lets run Killbox

• First copy the filepaths in the box below to your clipboard, by highlighting them and pressing Ctrl+C.

C:\Documents and Settings\Parthiv\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-37d0245a-6db441da.class
C:\Documents and Settings\Parthiv\Local Settings\Temp\ICD1.tmp\UWA7P_0001_N91M0809NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe
C:\WINDOWS\system32\obvrvlmg.dll
C:\WINDOWS\SYSTEM32\mrjkyelb.dll
C:\WINDOWS\system32\abesrcen.exe
C:\WINDOWS\system32\afwdeebn.dll
C:\WINDOWS\system32\btqwqdgt.exe
C:\WINDOWS\system32\btuierje.dll
C:\WINDOWS\system32\crjgqdgu.exe
C:\WINDOWS\system32\cspqggfl.dll
C:\WINDOWS\system32\cxroukkb.exe
C:\WINDOWS\system32\fdhxbgmp.exe
C:\WINDOWS\system32\fndsncvo.dll
C:\WINDOWS\system32\hkobrrfn.exe
C:\WINDOWS\system32\inssiilq.dll
C:\WINDOWS\system32\kfrrgmvw.dll
C:\WINDOWS\system32\ldqbxpfs.exe
C:\WINDOWS\system32\lnebcbet.dll
C:\WINDOWS\system32\mllhotpm.dll
C:\WINDOWS\system32\mpgmwjry.dll
C:\WINDOWS\system32\nnaholsj.dll
C:\WINDOWS\system32\oacqpmdu.dll
C:\WINDOWS\system32\pfbypfai.dll
C:\WINDOWS\system32\pfdxiscb.dll
C:\WINDOWS\system32\pucapfek.dll
C:\WINDOWS\system32\qolepylj.exe
C:\WINDOWS\system32\rpcxhqkk.dll
C:\WINDOWS\system32\sjthitvd.dll
C:\WINDOWS\system32\ublmfwoc.dll
C:\WINDOWS\system32\uygftijg.dll
C:\WINDOWS\system32\vtgclscd.dll
C:\WINDOWS\system32\vtkwfadj.exe
C:\WINDOWS\system32\xliadvty.exe

• Open Killbox and check a mark in the "RadioBox" which says Delete On Reboot
• Click File > Paste from Clipboard.
• Click All Files button.
• Click on the Red button with a Cross, and answer Yes when prompted to Backup and Delete the pasted files.
• Answer Yes when prompted to Reboot now.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, download and run missingfilesetup.exe. Then try Killbox again.

Run a scan with HJT, when finished check the following items (if found).

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\system32\hbklwruk.dll (file missing)
O2 - BHO: (no name) - {E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} - C:\WINDOWS\system32\obvrvlmg.dll
O2 - BHO: (no name) - {FFD987C9-7884-4C39-89CC-6C5CF3B619Bf} - C:\WINDOWS\system32\vtgclscd.dll

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://scanner.sysprotect.com
O15 - Trusted Zone: http://*.systemdoctor.com
O15 - Trusted Zone: http://www.winantivirus.com
O15 - Trusted Zone: http://www.winantiviruspro.com
O15 - Trusted Zone: http://download.cdn.winsoftware.com

O20 - Winlogon Notify: mrjkyelb - C:\WINDOWS\SYSTEM32\mrjkyelb.dll


Close all open windows and click Fix Checked.

Now Run ATF Cleaner

• 1st Ensure your Internet Browser is closed.
• Double click ATF-Cleaner.exe to run the program.
• Check the following boxes:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Recycle Bin
  • Java Cache
• The rest are optional - if you want to remove the lot, check Select All.
• Now click Empty Selected.
• When you get the Done Cleaning message, click OK.
  
• If you use Firefox browser.
  • Click Firefox at the top and choose: Select All
  • If you would like to keep your saved passwords, please click No at the prompt.
  • Click the Empty Selected button.
• If you use Opera browser.
  • Click Opera at the top and choose: Select All
  • If you would like to keep your saved passwords, please click No at the prompt.
  • Click the Empty Selected button.

Reboot your computer into Safe Mode

• If your computer is running, shut down Windows, then turn the power off.
• Wait 30 seconds, then turn the computer on, and begin tapping the F8 key.
• The Windows Advanced Options Menu appears. (If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again).
• Select Safe Mode using the up/down arrow keys.
• Press Enter.
• Log on with an account that has administrator priviledges (NOT the account named Administrator) your usual account will probably be an administrator account.

Run a scan with AVG.

• Click on Scanner
  • Click on the Settings tab, and set the following settings.
    • How to act
    • Click on Recommended actions, and set to Quarantine.
  • How to scan
    • Check all options.
  • Possibly unwanted software.
    • Check all options.
  • Reports
    • Check Automatically generate report after every scan.
    • Uncheck Only if threats were found.
  • What to scan
    • Check Scan every file.
• Click on the Scan tab.
  • Click on Complete System Scan and the scan will begin.
  • When the scan has finished
  • Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
  • At the bottom of the window click on the Apply all Actions button.

Note: Don't save the report before you hit the Apply action button.

Close AVG Anti-Spyware.

AVG will save a report in the following location C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

REBOOT INTO NORMAL MODE

Now run another Kaspersky scan please.

Now can you send me the following logs please:

• Kaspersky log.
• AVG log
• New HJT log.

Please post each log seperately.

Ok Here are the new logs… KASPERSKY LOG>.. ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Saturday, February 17, 2007 7:03:06 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 18/02/2007 Kaspersky Anti-Virus database records: 269106 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 73419 Number of viruses found: 16 Number of infected objects: 163 / 0 Number of suspicious objects: 0 Duration of the scan process: 00:56:53 Infected Object Name / Virus Name / Last Action C:\!KillBox\afwdeebn.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\!KillBox\btuierje.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\cspqggfl.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\fndsncvo.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\inssiilq.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\lnebcbet.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\mllhotpm.dll Infected: Trojan.Win32.BHO.g skipped C:\!KillBox\mpgmwjry.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\nnaholsj.dll Infected: Trojan.Win32.BHO.g skipped C:\!KillBox\oacqpmdu.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\!KillBox\omfg.class-37d0245a-6db441da.class Infected: Trojan-Downloader.Java.OpenStream.y skipped C:\!KillBox\pfbypfai.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\!KillBox\pfdxiscb.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\pucapfek.dll Infected: Trojan.Win32.BHO.g skipped C:\!KillBox\qolepylj.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\!KillBox\rpcxhqkk.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\sjthitvd.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\ublmfwoc.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\UWA7P_0001_N91M0809NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\!KillBox\UWA7P_0001_N91M0809NetInstaller.exe( 1) Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\!KillBox\uygftijg.dll Infected: Packed.Win32.Klone.j skipped C:\!KillBox\vtgclscd.dll Infected: Packed.Win32.Klone.j skipped C:\CCProxy\CDial.dll Infected: not-a-virus:Server-Proxy.Win32.CCProxy.63 skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_5b150187-0f05-4c72-917c-77c8e6964ac4 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\bmcchdxc.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\bwyaqycs.dll.bac_a02664 Infected: Trojan.Win32.BHO.g skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ctwvcwld.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\DP.sys.bac_a02664 Infected: Trojan.Win32.Agent.ny skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\dxrguyno.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ekcsytqx.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\epljcndp.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\fofxlqpp.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\glecqble.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\hbglncxf.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\hgquaute.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\hswlxekn.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ibniduks.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ihjlhsrs.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ixchqnon.exe.bac_a02664 Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\jigsbiqd.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\jimbdelq.dll.bac_a02664 Infected: Trojan.Win32.BHO.g skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ldbgbvts.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\lwheqnnu.dll.bac_a02664 Infected: Trojan.Win32.BHO.o skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\mykibodi.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\nmpfsdlr.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\oobcwjkm.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\osrqngww.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\pccdrcto.exe.bac_a02664 Infected: Trojan.Win32.Small.ju skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\qeydcpvt.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\rscshdje.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\smaggblb.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\ssshstuq.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\vhuiftgi.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\.housecall6.6\Quarantine\vtnmmojf.dll.bac_a02664 Infected: Trojan-Spy.Win32.VBStat.h skipped C:\Documents and Settings\Parthiv\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\~DFD24B.tmp Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Parthiv\ntuser.dat.LOG Object is locked skipped C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream skipped C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll Infected: not-a-virus:AdWare.Win32.MyWay.v skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066825.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066827.exe Infected: Trojan.Win32.Small.ju skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066828.exe Infected: Trojan.Win32.Small.ju skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066829.exe Infected: Trojan.Win32.Small.ju skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066830.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066831.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066832.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066833.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066834.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066835.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066836.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066837.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066838.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066839.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066840.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066841.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066842.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066843.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066844.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066845.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066846.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066847.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066848.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066849.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066850.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066852.dll Infected: Trojan.Win32.BHO.o skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066853.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP601\A0074337.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP602\A0074556.dll Infected: not-a-virus:AdWare.Win32.Webdir.b skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075613.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075615.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075620.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075621.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075624.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075625.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075628.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075630.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075632.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075634.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075637.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075638.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075639.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075640.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075645.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075656.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075660.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075663.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075665.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075667.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075669.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075670.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075671.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075672.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075674.dll Infected: Trojan-Spy.Win32.VBStat.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075696.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075698.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075700.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075703.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075705.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075708.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075709.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075710.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075711.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075712.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075713.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075714.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075715.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075716.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075717.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075718.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075719.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075720.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075721.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075755.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075756.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075757.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075758.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075759.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075760.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075761.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075762.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075763.exe Infected: Trojan.Win32.Agent.ny skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075764.dll Infected: Trojan-Spy.Win32.Agent.ps skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\change.log Object is locked skipped C:\VundoFix Backups\aarcrkhm.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\alhheuif.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\dcdqcnvk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\VundoFix Backups\dffctpym.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\dvamenrj.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\ektcburf.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\fcgylcgf.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\hbklwruk.dll.bad Infected: Trojan.Win32.BHO.g skipped C:\VundoFix Backups\hmkmackp.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\hsewidtp.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\iaumoqsw.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\iifeecma.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\ikaoibkj.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped C:\VundoFix Backups\iyideueb.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\lxmrpnib.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\rsjotdrd.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\sxmmluul.exe.bad Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\VundoFix Backups\tqjcgqht.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\vrijkklm.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\vylsoouw.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\weapkcky.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\xfxalatg.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\xqtogqtg.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\xxkdrxhp.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\VundoFix Backups\yuxflcxu.dll.bad Infected: Trojan-Spy.Win32.VBStat.j skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_Conexant D110 MDC V.9x Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{15EB09E7-90F8-48CF-BD33-D6F62E8C311B}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{8EC3FE4C-D8BB-41BE-917E-227DD5C2F140}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

AVG LOG… ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 4:46:55 PM 2/17/2007 + Scan result: C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075749.exe -> Dropper.Agent.xk : Cleaned with backup (quarantined). C:\!KillBox\kfrrgmvw.dll -> Logger.Agent.ps : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075706.dll -> Logger.Agent.ps : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075614.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075616.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075617.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075618.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075619.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075622.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075623.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075626.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075627.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075629.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075631.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075633.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075636.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075642.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075644.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075646.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075647.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075648.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075649.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075650.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075651.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075652.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075653.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075654.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075655.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075657.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075658.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075661.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075662.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075664.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075666.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075668.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075673.dll -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\aggmsppp.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\bkvrodih.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\bmtkbogn.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\ciutgecs.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\crpmevws.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\dnkefhfg.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\drgxigtl.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\eoleqipm.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\eyjkomlp.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\fcwlvvnt.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\hcspgnsh.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\hnvndcde.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\hudpvrpd.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\jvivdctd.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\lvngggha.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\mdvcorni.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\mkevvqtv.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\naeepujb.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\ofxmgjwc.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\oksqmmuk.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\opxvynqx.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\oxtixqht.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\pacmpmbi.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\pkrqixms.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\rgqlwwsm.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\rtlkniaw.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\sgbjfksj.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\tnjjlyrr.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\tnwxhjok.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\uvoaajrr.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\vsskbrvg.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\wayylfsw.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\VundoFix Backups\yjisepnt.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP602\A0074555.dll -> Trojan.Agent.acl : Cleaned with backup (quarantined). C:\!KillBox\abesrcen.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\btqwqdgt.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\crjgqdgu.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\cxroukkb.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\fdhxbgmp.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\hkobrrfn.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\ldqbxpfs.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\vtkwfadj.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\!KillBox\xliadvty.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066851.sys -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075695.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075697.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075699.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075701.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075702.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075704.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075707.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075722.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP608\A0075723.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066854.dll -> Trojan.BHO.g : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075635.dll -> Trojan.BHO.g : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP607\A0075659.dll -> Trojan.BHO.g : Cleaned with backup (quarantined). C:\VundoFix Backups\huaqwsws.dll.bad -> Trojan.BHO.g : Cleaned with backup (quarantined). C:\VundoFix Backups\svyjkoxg.dll.bad -> Trojan.BHO.g : Cleaned with backup (quarantined). C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP578\A0066826.exe -> Trojan.Small.ju : Cleaned with backup (quarantined). ::Report end

Hey Gary, Thanks a lot for your help so far. I have done pretty much everything you said. One note, About that Housecall quarantine you said to delete, I had already deleted the whole folder >< So was kinda late. I am posting my kaspersky log again, it still found lotta infections…see if you can suggest something for it… ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Monday, February 19, 2007 12:39:29 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 19/02/2007 Kaspersky Anti-Virus database records: 269774 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 67335 Number of viruses found: 8 Number of infected objects: 25 / 0 Number of suspicious objects: 0 Duration of the scan process: 00:53:44 Infected Object Name / Virus Name / Last Action C:\CCProxy\CDial.dll Infected: not-a-virus:Server-Proxy.Win32.CCProxy.63 skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_5b150187-0f05-4c72-917c-77c8e6964ac4 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Parthiv\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temp\~DFC525.tmp Object is locked skipped C:\Documents and Settings\Parthiv\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Parthiv\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Parthiv\ntuser.dat.LOG Object is locked skipped C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream skipped C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll Infected: not-a-virus:AdWare.Win32.MyWay.v skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000025.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000026.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000027.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000028.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000029.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000030.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000031.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000032.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000034.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000035.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000036.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000037.dll Infected: Trojan-Spy.Win32.VBStat.h skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000038.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000039.dll Infected: Trojan.Win32.BHO.g skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000040.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000041.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000042.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000043.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000044.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000045.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\A0000046.dll Infected: Packed.Win32.Klone.j skipped C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP1\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_Conexant D110 MDC V.9x Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{E8A03D19-644E-45C5-A119-C60C16570889}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{9B80ADA3-644C-4CA5-9AEA-5B7F805E456F}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\cpliebaf.dll Infected: Trojan.Win32.BHO.g skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Hi Parth,

Kaspersky flags a lot of things that are not infections, some are items that are "locked" because their parent processes are running, they're mostly logs and dat files.

Your System Restore points are also infected, they can't infect you unless you do a restore. If you follow the instructions given in my last post you can clear your Restore Points and purge them of infection.

There are also a couple of FPs (False Positives) in the log.

However there is one item in your latest log that I'm interested in


I'd like you to check a file(s) for Viruses.

• Go to VirusTotal or Jotti's, and scan the following file(s).

C:\WINDOWS\system32\cpliebaf.dll

• Click on the Browse button at the top of the screen.
• Browse to the file.
• Click OK.
• Click Send, and the file will upload to VirusTotal / Jotti, where it will be scanned by several anti-virus programmes.
• After a while, a window will open, with details of what the scans found.
• Note details of any viruses found.
• Post me the details please.