What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Outerinfo And Other Adware Popup Removal

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I really need help. I am bombarded with popups constantly. It's so bad I can't use the dsl. I have an adware cleaner called noadware. It got alot, but I also know OUTERINFO is a huge probelm and one of the main causes for the popups, I've tried a lot of programs that say they would get rid of it, but it doesn't work. Can anyone help? Listed below is my Hijackthis2 log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:25:47 PM, on 8/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\bepmnuaj.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\i34yuc387.exe
C:\WINDOWS\kerknkbA.exe
C:\WINDOWS\g4356cbvy63.exe
C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Common Files\?asks\w?crtupd.exe
C:\Program Files\NoAdware5.0\NoAdware5.exe
C:\PROGRA~1\SMANTE~1\javaw.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - Default URLSearchHook is missing
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0001377
O4 - HKLM\..\Run: [{00139D28-0703-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0703-1033-1217-020409200001}\Update.exe" mc-110-12-0001377
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [i34yuc387] C:\WINDOWS\i34yuc387
O4 - HKLM\..\Run: [kerknkbA] C:\WINDOWS\kerknkbA.exe
O4 - HKLM\..\Run: [g4356cbvy63] C:\WINDOWS\g4356cbvy63
O4 - HKLM\..\Run: [{39-9D-D2-28-ZN}] C:\windows\system32\lrdsrego.exe ICM001
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Krvbhlka] "C:\Documents and Settings\ANN KLOPP\Application Data\s?curity\regedit.exe" 99001396
O4 - HKCU\..\Run: [Iig] "C:\Documents and Settings\ANN KLOPP\Application Data\??crosoft\w?auboot.exe"
O4 - HKCU\..\Run: [Jvyguqm] C:\WINDOWS\SYSTEM32\?dobe\d?dplay.exe
O4 - HKCU\..\Run: [Wsocpdd] "C:\Program Files\?icrosoft.NET\m?iexec.exe"
O4 - HKCU\..\Run: [Qrdspemh] "C:\Program Files\Common Files\?asks\w?crtupd.exe"
O4 - HKCU\..\Run: [NoAdware5] "C:\Program Files\NoAdware5.0\NoAdware5.exe" :Min:
O4 - HKCU\..\Run: [Aida] "C:\PROGRA~1\SMANTE~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKCU\..\Policies\Explorer\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0000137
O4 - HKCU\..\Policies\Explorer\Run: [{00139D28-0703-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0703-1033-1217-020409200001}\Update.exe" mc-110-12-0000137
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0000137 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0000137 (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: DomainService - - C:\WINDOWS\system32\bepmnuaj.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE

–
End of file - 8560 bytes
Post #2
Hello redhead2 and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem. As you have already guessed, your system is in pretty bad shape. I will do my utmost to help you get cleaned up but there may be some serious damage done to your system.


A. Please download this tool to your desktop:
http://www.uploads.ejvindh.net/rootchk.exe
Run the program. After a short time a logfile will turn up. Copy the contents of the log into the thread.

B. Please provide a list of uninstallable programs.

To Provide a List of Installed Programs
  • Run HijackThis.
  • Click Config>>Miscellaneous Tools>>Open Uninstall Manager>>Save List
  • Save list to Desktop
  • Copy the Notepad list and Paste it into this thread.

Good Luck,

Trevuren
Post #3
First of, thanks for your help. The root check log is listed below, but when it did it and it was scanning, it did popup saying some error when it was doing the scan gmer's catchme and then a few seconds later created a log listing whats below. I ran it twice and both times the error happened and this is the log created:

********************************* ROOTCHK-(21-07-07)-LOG, by ejvindh
Fri 08/10/2007 11:03:07.98

Driver Core (visible) is present. Run COMBOFIX by sUBs or SDFIX by AndyManchesta.

********************************* ROOTCHK-LOG-end


catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-10 11:03:09
Windows 5.1.2600 Service Pack 2
scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

hidden processes: 0
hidden files: 0



HERE IS THE HIJACKTHIS LOG:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:32 AM, on 8/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\bepmnuaj.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\i34yuc387.exe
C:\WINDOWS\kerknkbA.exe
C:\WINDOWS\g4356cbvy63.exe
C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\Program Files\Common Files\?asks\w?crtupd.exe
C:\Program Files\NoAdware5.0\NoAdware5.exe
C:\PROGRA~1\SMANTE~1\javaw.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
R3 - Default URLSearchHook is missing
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0001377
O4 - HKLM\..\Run: [{00139D28-0703-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0703-1033-1217-020409200001}\Update.exe" mc-110-12-0001377
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [i34yuc387] C:\WINDOWS\i34yuc387
O4 - HKLM\..\Run: [kerknkbA] C:\WINDOWS\kerknkbA.exe
O4 - HKLM\..\Run: [g4356cbvy63] C:\WINDOWS\g4356cbvy63
O4 - HKLM\..\Run: [{39-9D-D2-28-ZN}] C:\windows\system32\lrdsrego.exe ICM001
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Krvbhlka] "C:\Documents and Settings\ANN KLOPP\Application Data\s?curity\regedit.exe" 99001396
O4 - HKCU\..\Run: [Iig] "C:\Documents and Settings\ANN KLOPP\Application Data\??crosoft\w?auboot.exe"
O4 - HKCU\..\Run: [Jvyguqm] C:\WINDOWS\SYSTEM32\?dobe\d?dplay.exe
O4 - HKCU\..\Run: [Wsocpdd] "C:\Program Files\?icrosoft.NET\m?iexec.exe"
O4 - HKCU\..\Run: [Qrdspemh] "C:\Program Files\Common Files\?asks\w?crtupd.exe"
O4 - HKCU\..\Run: [NoAdware5] "C:\Program Files\NoAdware5.0\NoAdware5.exe" :Min:
O4 - HKCU\..\Run: [Aida] "C:\PROGRA~1\SMANTE~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKCU\..\Policies\Explorer\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0000137
O4 - HKCU\..\Policies\Explorer\Run: [{00139D28-0703-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0703-1033-1217-020409200001}\Update.exe" mc-110-12-0000137
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0000137 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{00139D28-0702-1033-1217-020409200001}] "C:\Program Files\Common Files\{00139D28-0702-1033-1217-020409200001}\Update.exe" mc-110-12-0000137 (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: DomainService - - C:\WINDOWS\system32\bepmnuaj.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE

–
End of file - 8610 bytes
Post #4
Please download this file - combofix.exe by sUBs
  • You must download it to your Desktop
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #5
Hi, here is the combofix log, followed by the hijackthis

1989-12-12 10:10	  386352	–a——	C:\Qoobox\Quarantine\C\WINDOWS\kerknkbA.exe.vir
2007-02-25 20:44	  70144	–a——	C:\Qoobox\Quarantine\C\Program Files\SMANTE~1\javaw.exe.vir
2007-02-28 17:32	  12800	–a——	C:\Qoobox\Quarantine\C\Program Files\Common Files\{30139~2\UnInstall.exe.vir
2007-03-08 02:22	  1	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\bund1\temp.txt.vir
2007-03-23 15:55	  0	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\svchost.exe.vir
2007-04-10 20:19	  100352	–a——	C:\Qoobox\Quarantine\C\Program Files\Common Files\{30139~1\Bar888.dll.vir
2007-04-10 20:19	  12800	–a——	C:\Qoobox\Quarantine\C\Program Files\Common Files\{30139~1\UnInstall.exe.vir
2007-04-29 08:26	  390241	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\core.cache.dsk.vir
2007-04-29 08:26	  72320	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\core.sys.vir
2007-06-25 08:53	  53248	–a——	C:\Qoobox\Quarantine\C\WINDOWS\uninst1014.exe.vir
2007-06-25 08:54	  53248	–a——	C:\Qoobox\Quarantine\C\WINDOWS\uni_eh44.exe.vir
2007-07-06 14:40	  192512	–a——	C:\Qoobox\Quarantine\C\WINDOWS\g4356cbvy63.exe.vir
2007-07-31 17:33	  54784	–a——	C:\Qoobox\Quarantine\C\WINDOWS\kerknkb.exe.vir
2007-07-31 17:33	  65536	–a——	C:\Qoobox\Quarantine\C\WINDOWS\dls0523pmw.exe.vir
2007-07-31 19:39	  9769	–a——	C:\Qoobox\Quarantine\C\WINDOWS\elpbn0578.exe.vir
2007-08-01 08:43	  60928	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\andvkqux.dll.vir
2007-08-01 08:44	  229888	–a——	C:\Qoobox\Quarantine\C\Program Files\Common Files\ASKS~1\w?crtupd.exe.vir
2007-08-04 12:16	  31254	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\hggddda.dll.vir
2007-08-04 12:39	  228960	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\awtqq.dll.vir
2007-08-04 12:39	  6467	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\qqtwa.bak1.vir
2007-08-05 17:20	  4672	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\tlhxjalu.exe.vir
2007-08-05 17:20	  66112	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\xpawhwrn.exe.vir
2007-08-05 17:22	  69184	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\ohqeninu.dll.vir
2007-08-05 20:16	  31254	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\urqronn.dll.vir
2007-08-06 11:59	  34816	–a——	C:\Qoobox\Quarantine\C\WINDOWS\rau001978.exe.vir
2007-08-06 20:39	  4672	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\lawtjged.exe.vir
2007-08-06 20:39	  66112	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\ryciauqb.exe.vir
2007-08-06 20:41	  4672	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\htdxujkg.exe.vir
2007-08-07 20:57	  66112	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\mffrwiag.exe.vir
2007-08-07 20:59	  4672	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\pjgjtruy.exe.vir
2007-08-09 10:32	  125504	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\dvxvdtbm.dll.vir
2007-08-09 10:33	  1192516	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\mbtdvxvd.ini.vir
2007-08-09 10:44	  917	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\winpfz32.sys.vir
2007-08-10 10:32	  1727054	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\qqtwa.bak2.vir
2007-08-10 10:37	  125504	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\nojtiopr.dll.vir
2007-08-10 10:56	  1213799	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\rpoitjon.ini.vir
2007-08-10 13:41	  70208	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\xxhjwead.dll.vir
2007-08-10 14:10	  1050	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_NET_AGENT.reg.cf
2007-08-10 14:10	  1098	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_DOMAINSERVICE.reg.cf
2007-08-10 14:10	  1220	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_CORE.reg.cf
2007-08-10 14:10	  2526	–a——	C:\Qoobox\Quarantine\Registry_backups\services_Net Agent.reg.cf
2007-08-10 14:10	  2956	–a——	C:\Qoobox\Quarantine\Registry_backups\services_DomainService.reg.cf
2007-08-10 14:10	  832	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_CMDSERVICE.reg.cf
2007-08-10 14:10	  846	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_CLIENT_IP-IPX.reg.cf
2007-08-10 14:10	  846	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_COM+_MESSAGES.reg.cf
2007-08-10 14:10	  862	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_NETWORK_MONITOR.reg.cf
2007-08-10 14:10	  950	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_WINDOWS_OVERLAY_COMPONENTS.reg.cf
2007-08-10 14:10	  994	–a——	C:\Qoobox\Quarantine\Registry_backups\services_core.reg.cf
2007-08-10 14:11	  1704385	–a——	C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\qqtwa.ini.vir
2007-08-10 14:12	  292457	–a——	C:\Qoobox\Quarantine\catchme2007-08-10_141644.25.zip
2007-08-10 14:12	  472	–a——	C:\Qoobox\Quarantine\catchme.log


Folder PATH listing
Volume serial number is 0013-9D28
C:\QOOBOX
\—Quarantine
	|   catchme.log
	|   catchme2007-08-10_141644.25.zip
	|   
	+—C
	|   +—Program Files
	|   |   +—Common Files
	|   |   |   +—ASKS~1
	|   |   |   |	   w?crtupd.exe.vir
	|   |   |   |	   
	|   |   |   +—{30139~1
	|   |   |   |	   Bar888.dll.vir
	|   |   |   |	   UnInstall.exe.vir
	|   |   |   |	   
	|   |   |   \—{30139~2
	|   |   |		   UnInstall.exe.vir
	|   |   |		   
	|   |   \—SMANTE~1
	|   |	   |   javaw.exe.vir
	|   |	   |   
	|   |	   \—S?mantec
	|   \—WINDOWS
	|	   |   dls0523pmw.exe.vir
	|	   |   elpbn0578.exe.vir
	|	   |   g4356cbvy63.exe.vir
	|	   |   kerknkb.exe.vir
	|	   |   kerknkbA.exe.vir
	|	   |   rau001978.exe.vir
	|	   |   uninst1014.exe.vir
	|	   |   uni_eh44.exe.vir
	|	   |   
	|	   \—SYSTEM32
	|		   |   andvkqux.dll.vir
	|		   |   awtqq.dll.vir
	|		   |   dvxvdtbm.dll.vir
	|		   |   hggddda.dll.vir
	|		   |   htdxujkg.exe.vir
	|		   |   lawtjged.exe.vir
	|		   |   mbtdvxvd.ini.vir
	|		   |   mffrwiag.exe.vir
	|		   |   nojtiopr.dll.vir
	|		   |   ohqeninu.dll.vir
	|		   |   pjgjtruy.exe.vir
	|		   |   qqtwa.bak1.vir
	|		   |   qqtwa.bak2.vir
	|		   |   qqtwa.ini.vir
	|		   |   rpoitjon.ini.vir
	|		   |   ryciauqb.exe.vir
	|		   |   tlhxjalu.exe.vir
	|		   |   urqronn.dll.vir
	|		   |   winpfz32.sys.vir
	|		   |   xpawhwrn.exe.vir
	|		   |   xxhjwead.dll.vir
	|		   |   
	|		   +—bund1
	|		   |	   temp.txt.vir
	|		   |	   
	|		   \—DRIVERS
	|				   core.cache.dsk.vir
	|				   core.sys.vir
	|				   svchost.exe.vir
	|				   
	\—Registry_backups
			LEGACY_CLIENT_IP-IPX.reg.cf
			LEGACY_CMDSERVICE.reg.cf
			LEGACY_COM+_MESSAGES.reg.cf
			LEGACY_CORE.reg.cf
			LEGACY_DOMAINSERVICE.reg.cf
			LEGACY_NETWORK_MONITOR.reg.cf
			LEGACY_NET_AGENT.reg.cf
			LEGACY_WINDOWS_OVERLAY_COMPONENTS.reg.cf
			services_core.reg.cf
			services_DomainService.reg.cf
			services_Net Agent.reg.cf


HIjackthis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:36, on 2007-08-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\i34yuc387.exe
C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\NoAdware5.0\NoAdware5.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [i34yuc387] C:\WINDOWS\i34yuc387
O4 - HKLM\..\Run: [{39-9D-D2-28-ZN}] C:\windows\system32\lrdsrego.exe ICM001
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Krvbhlka] "C:\Documents and Settings\ANN KLOPP\Application Data\s?curity\regedit.exe" 99001396
O4 - HKCU\..\Run: [Iig] "C:\Documents and Settings\ANN KLOPP\Application Data\??crosoft\w?auboot.exe"
O4 - HKCU\..\Run: [Jvyguqm] C:\WINDOWS\SYSTEM32\?dobe\d?dplay.exe
O4 - HKCU\..\Run: [Wsocpdd] "C:\Program Files\?icrosoft.NET\m?iexec.exe"
O4 - HKCU\..\Run: [Qrdspemh] "C:\Program Files\Common Files\?asks\w?crtupd.exe"
O4 - HKCU\..\Run: [NoAdware5] "C:\Program Files\NoAdware5.0\NoAdware5.exe" :Min:
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE

–
End of file - 7546 bytes
Post #6
Sorry to say that you posted the wrong report. :wavey:

The one I require is the one that popped up on your screen after the tool had finished running. It can be found here: C:\ComboFix.txt

Please locate this report and post it in your reply.

Thanks,

Trevuren
Post #7
Sorry about that. I found this file in the Combofix Folder. I hope its it. Any way, thanks for your help. I know its working, because I've been on the internet for a few minutes and only got 4 popups, one from something called zedo. But that a great relief from the ten to twently I was getting every minute. Thanks for everything you're doing. ComboFix 07-08-10.8 - "ANN KLOPP" 2007-08-10 14:22:27.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.392 [GMT -5:00] ((((((((((((((((((((((((( Files Created from 2007-07-10 to 2007-08-10 ))))))))))))))))))))))))))))))) 2007-08-10 13:40 51,200 –a—— C:\WINDOWS\nircmd.exe 2007-08-10 10:34 75,328 –a—— C:\WINDOWS\SYSTEM32\vkippnut.exe 2007-08-10 10:32 75,328 –a—— C:\WINDOWS\SYSTEM32\umjwhduv.exe 2007-08-09 22:25 d——– C:\Program Files\Trend Micro 2007-08-09 22:15 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\AdobeAUM 2007-08-09 12:50 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Earthlink 2007-08-09 10:52 d——– C:\Program Files\NoAdware5.0 2007-08-09 10:23 75,328 –a—— C:\WINDOWS\SYSTEM32\bepmnuaj.exe 2007-08-08 14:01 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE 2007-08-08 13:54 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\InstallShield 2007-08-08 13:43 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\ErrorSmart 2007-08-08 12:54 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\ErrorSmart 2007-08-08 11:22 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\EarthLink Toolbar 2007-08-08 11:05 d——– C:\Program Files\WinPoET Broadband Connection 2007-08-08 10:35 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\EarthLink Toolbar 2007-08-08 10:33 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Visual Networks 2007-08-08 10:23 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Earthlink 2007-08-07 17:32 d——– C:\DOCUME~1\Owner\APPLIC~1\EarthLink 2007-08-07 17:32 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\EarthLink 2007-08-07 17:31 d——– C:\Program Files\EarthLink 2007-08-04 15:12 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Symantec 2007-08-04 12:37 192,589 –a—— C:\WINDOWS\SYSTEM32\pwinsmdt.exe 2007-08-02 11:26 d——– C:\Program Files\XoftSpySE 2007-07-31 19:40 d——– C:\Temp 2007-07-31 17:33 224,283 –a—— C:\WINDOWS\Setup167.exe 2007-07-19 13:09 53,248 –a—— C:\WINDOWS\uni_eh45.exe 2007-07-19 13:05 53,248 –a—— C:\WINDOWS\uninst1017.exe 2007-07-19 13:02 192,512 –a—— C:\WINDOWS\i34yuc387.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-09 11:58 ——— d–hs—- C:\Program Files\outlook 2007-08-08 13:54 ——— d–h—– C:\Program Files\InstallShield Installation Information 2007-08-08 11:37 ——— d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Corel 2007-08-08 10:37 ——— d——– C:\Program Files\Common Files\EarthLink 2007-08-08 10:33 ——— d——– C:\Program Files\EarthLink TotalAccess 2007-08-02 11:25 ——— d——– C:\Program Files\XoftSpy 2007-07-02 15:48 ——— d——– C:\Program Files\Microsoft Picture It! PhotoPub 2007-06-29 19:13 ——— d——– C:\Program Files\iTunes 2007-06-23 10:27 ——— d——– C:\Program Files\TvInternet 2007-06-15 14:32 ——— d——– C:\Program Files\Apple Software Update 2007-05-26 15:42 217 –a—— C:\WINDOWS\yfguag.exe 2007-05-16 10:12 86528 ——— C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 10:12 85504 ——— C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 10:12 683520 –a—— C:\WINDOWS\system32\inetcomm.dll 2007-05-16 10:12 683520 ——— C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 10:12 510976 ——— C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 10:12 1314816 ——— C:\WINDOWS\system32\dllcache\msoe.dll 2007-03-12 20:48 496 –a—— C:\Program Files\Common Files\quca 2007-03-01 09:53 142 –a—— C:\Program Files\Common Files\rtele.html 2005-01-12 20:55 37918 –a—— C:\Program Files\remove.exe 2003-02-05 12:41 207759 –a–c— C:\Program Files\INSTALL.LOG 1999-07-21 13:53 5546 –a—— C:\Program Files\Desktop2.txt 1999-07-21 13:53 508210 –a—— C:\Program Files\Desktop2.exe 1999-07-21 13:53 1723518 –a—— C:\Program Files\Desktop2.cca ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 08:59] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2003-02-05 12:36] "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44] "LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05] "i34yuc387"="C:\WINDOWS\i34yuc387" [] "{39-9D-D2-28-ZN}"="C:\windows\system32\lrdsrego.exe" [] "IPInSightMonitor 01"="C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe" [2005-08-10 21:10] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24] "Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-08 15:00] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09] "Krvbhlka"="C:\Documents and Settings\ANN KLOPP\Application Data\s?curity\regedit.exe" [] "Iig"="C:\Documents and Settings\ANN KLOPP\Application Data\??crosoft\w?auboot.exe" [] "Jvyguqm"="C:\WINDOWS\SYSTEM32\?dobe\d?dplay.exe" [] "Wsocpdd"="C:\Program Files\?icrosoft.NET\m?iexec.exe" [] "Qrdspemh"="C:\Program Files\Common Files\?asks\w?crtupd.exe" [] "E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 15:24] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Documents and Settings\ANN KLOPP\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 10:00:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 10:00:00] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2003-02-05 12:32:49] Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-06-29 18:15:10] MySoftware NewsFlash.lnk - C:\Program Files\Common Files\MySoftware\NewsFlsh.exe [2003-02-27 20:29:35] R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMSM.sys R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys S2 CoachCap;Concord EyeQ Duo 2000 USB Video Capture V1.00;C:\WINDOWS\system32\drivers\CoachCap.sys S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys S3 WrKPoET2000;WrKPoET2000;\??\C:\Program Files\WinPoET Broadband Connection\WrKPoET2000.sys Contents of the 'Scheduled Tasks' folder 2007-04-21 13:54:33 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe 2007-08-08 18:43:56 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job - C:\Program Files\errorsmart\ErrorSmart.exe 2007-08-08 18:00:56 C:\WINDOWS\Tasks\XoftSpy.job - C:\Program Files\XoftSpy\XoftSpy.exe 2007-08-10 19:16:30 C:\WINDOWS\Tasks\XoftSpySE 2.job 2007-08-02 16:26:37 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe
Post #8
A. There is a file in your log of which I am unsure. For that reason, I need you to submit it to Jotti's for analysis.

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

C:\Program Files\remove.exe

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis.


B. Please RUN HijackThis
  • Click the SCAN button to produce a log.

  • Place a check mark beside each one of the following items:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    O4 - HKLM\..\Run: [i34yuc387] C:\WINDOWS\i34yuc387
    O4 - HKLM\..\Run: [{39-9D-D2-28-ZN}] C:\windows\system32\lrdsrego.exe ICM001
    O4 - HKCU\..\Run: [Krvbhlka] "C:\Documents and Settings\ANN KLOPP\Application Data\s?curity\regedit.exe" 99001396
    O4 - HKCU\..\Run: [Iig] "C:\Documents and Settings\ANN KLOPP\Application Data\??crosoft\w?auboot.exe"
    O4 - HKCU\..\Run: [Jvyguqm] C:\WINDOWS\SYSTEM32\?dobe\d?dplay.exe
    O4 - HKCU\..\Run: [Wsocpdd] "C:\Program Files\?icrosoft.NET\m?iexec.exe"
    O4 - HKCU\..\Run: [Qrdspemh] "C:\Program Files\Common Files\?asks\w?crtupd.exe"
    O4 - HKCU\..\Run: [NoAdware5] "C:\Program Files\NoAdware5.0\NoAdware5.exe" :Min:
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

  • Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button then EXIT the program.

C. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://forums.tomcoyote.org/Outerinfo_Othe…tml#entry393343

Collect::
C:\WINDOWS\Setup167.exe
C:\WINDOWS\uni_eh45.exe
C:\WINDOWS\uninst1017.exe
C:\Program Files\Common Files\rtele.html
C:\Program Files\Desktop2.txt
C:\Program Files\Desktop2.exe
C:\Program Files\Desktop2.cca

File::
C:\WINDOWS\SYSTEM32\vkippnut.exe
C:\WINDOWS\SYSTEM32\umjwhduv.exe
C:\WINDOWS\SYSTEM32\bepmnuaj.exe
C:\WINDOWS\SYSTEM32\pwinsmdt.exe
C:\WINDOWS\i34yuc387.exe
C:\WINDOWS\yfguag.exe

Folder::
C:\Program Files\NoAdware5.0
C:\Program Files\Common Files\quca

DirLook::
C:\Program Files\outlook


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. Additonally, ComboFix will generate the following files on your desktop
  • A zipped file on your desktop called Submit [Date Time].zip
  • And another file named - CF-Submit.htm
6. ComboFix may need to reboot to finish its work. Let it.

7. When CF has finished running, it will generate the ComboFix.log which will appear on your screen.

8. If CF-Submit.htm is detected, ComboFix will generate this message box:

[external image: Posted Image]

Clicking OK will cause the machine's browser to load CF-Submit.htm

[external image: Posted Image]

9. Click the "Browse" button and locate the Submit [Date Time].zip file on your desktop.
  • Click on the file to Select it.
  • Submit the file by clicking "OK"
10. Once the file has been submitted, please DELETE both files on your desktop.

11. Post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log (run after ComboFix has finished its work.)
Post #9
ComboFix 07-08-10.8 - "ANN KLOPP" 2007-08-10 20:40:50.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.353 [GMT -5:00]
Command switches used :: C:\Documents and Settings\ANN KLOPP\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\SYSTEM32\vkippnut.exe
C:\WINDOWS\SYSTEM32\umjwhduv.exe
C:\WINDOWS\SYSTEM32\bepmnuaj.exe
C:\WINDOWS\SYSTEM32\pwinsmdt.exe
C:\WINDOWS\i34yuc387.exe
C:\WINDOWS\yfguag.exe


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\quca\
C:\Program Files\Common Files\rtele.html
C:\Program Files\Desktop2.cca
C:\Program Files\Desktop2.exe
C:\Program Files\Desktop2.txt
C:\Program Files\NoAdware5.0
C:\Program Files\NoAdware5.0\logs\Date(9-8-2007) Time(11-58-35).txt
C:\Program Files\NoAdware5.0\logs\Date(9-8-2007) Time(12-10-0).txt
C:\Program Files\NoAdware5.0\logs\Date(9-8-2007) Time(13-15-50).txt
C:\Program Files\NoAdware5.0\logs\Date(9-8-2007) Time(16-23-3).txt
C:\Program Files\NoAdware5.0\noadware4_081007.na
C:\Program Files\NoAdware5.0\NoAdware5.exe
C:\Program Files\NoAdware5.0\NoAdwareBackup\8,9,2007_11,57,59.zip
C:\Program Files\NoAdware5.0\NoAdwareBackup\8,9,2007_12,9,57.zip
C:\Program Files\NoAdware5.0\NoAdwareBackup\8,9,2007_13,15,45.zip
C:\Program Files\NoAdware5.0\NoAdwareBackup\8,9,2007_16,4,23.zip
C:\Program Files\NoAdware5.0\nutils.dll
C:\Program Files\NoAdware5.0\unins000.dat
C:\Program Files\NoAdware5.0\unins000.exe
C:\WINDOWS\i34yuc387.exe
C:\WINDOWS\Setup167.exe
C:\WINDOWS\SYSTEM32\bepmnuaj.exe
C:\WINDOWS\SYSTEM32\pwinsmdt.exe
C:\WINDOWS\SYSTEM32\umjwhduv.exe
C:\WINDOWS\SYSTEM32\vkippnut.exe
C:\WINDOWS\uni_eh45.exe
C:\WINDOWS\uninst1017.exe
C:\WINDOWS\yfguag.exe


((((((((((((((((((((((((( Files Created from 2007-07-11 to 2007-08-11 )))))))))))))))))))))))))))))))


2007-08-10 13:40 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-09 22:25 d——– C:\Program Files\Trend Micro
2007-08-09 22:15 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\AdobeAUM
2007-08-09 12:50 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Earthlink
2007-08-08 14:01 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2007-08-08 13:54 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\InstallShield
2007-08-08 13:43 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\ErrorSmart
2007-08-08 12:54 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\ErrorSmart
2007-08-08 11:22 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\EarthLink Toolbar
2007-08-08 11:05 d——– C:\Program Files\WinPoET Broadband Connection
2007-08-08 10:35 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\EarthLink Toolbar
2007-08-08 10:33 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Visual Networks
2007-08-08 10:23 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Earthlink
2007-08-07 17:32 d——– C:\DOCUME~1\Owner\APPLIC~1\EarthLink
2007-08-07 17:32 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\EarthLink
2007-08-07 17:31 d——– C:\Program Files\EarthLink
2007-08-04 15:12 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Symantec
2007-08-02 11:26 d——– C:\Program Files\XoftSpySE
2007-07-31 19:40 d——– C:\Temp


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-09 11:58 ——— d–hs—- C:\Program Files\outlook
2007-08-08 13:54 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-08 11:37 ——— d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Corel
2007-08-08 10:37 ——— d——– C:\Program Files\Common Files\EarthLink
2007-08-08 10:33 ——— d——– C:\Program Files\EarthLink TotalAccess
2007-08-02 11:25 ——— d——– C:\Program Files\XoftSpy
2007-07-02 15:48 ——— d——– C:\Program Files\Microsoft Picture It! PhotoPub
2007-06-29 19:13 ——— d——– C:\Program Files\iTunes
2007-06-23 10:27 ——— d——– C:\Program Files\TvInternet
2007-06-15 14:32 ——— d——– C:\Program Files\Apple Software Update
2007-05-16 10:12 86528 ——— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 10:12 85504 ——— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 10:12 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 10:12 683520 ——— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 10:12 510976 ——— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 10:12 1314816 ——— C:\WINDOWS\system32\dllcache\msoe.dll
2007-03-12 20:48 496 –a—— C:\Program Files\Common Files\quca
2005-01-12 20:55 37918 –a—— C:\Program Files\remove.exe
2003-02-05 12:41 207759 –a–c— C:\Program Files\INSTALL.LOG


(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))


—- Directory of C:\Program Files\outlook —-



((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 08:59]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2003-02-05 12:36]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44]
"LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"IPInSightMonitor 01"="C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe" [2005-08-10 21:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-08 15:00]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 15:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Documents and Settings\ANN KLOPP\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2003-02-05 12:32:49]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-06-29 18:15:10]
MySoftware NewsFlash.lnk - C:\Program Files\Common Files\MySoftware\NewsFlsh.exe [2003-02-27 20:29:35]

R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMSM.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
S2 CoachCap;Concord EyeQ Duo 2000 USB Video Capture V1.00;C:\WINDOWS\system32\drivers\CoachCap.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys
S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys
S3 WrKPoET2000;WrKPoET2000;\??\C:\Program Files\WinPoET Broadband Connection\WrKPoET2000.sys


Contents of the 'Scheduled Tasks' folder
2007-04-21 13:54:33 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-08 18:43:56 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job - C:\Program Files\errorsmart\ErrorSmart.exe
2007-08-08 18:00:56 C:\WINDOWS\Tasks\XoftSpy.job - C:\Program Files\XoftSpy\XoftSpy.exe
2007-08-11 01:46:16 C:\WINDOWS\Tasks\XoftSpySE 2.job
2007-08-02 16:26:37 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe
Here you go. But the wierdest thing. The combofix file before was in a folder titled combofix, but this time it was located in the C: Combofix.txt. Just weird I guess.


catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-10 20:46:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-10 20:48:03 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-10 20:47

— E O F —



HIJACKTHIS LOG


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:08 PM, on 8/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE

–
End of file - 6364 bytes
Post #11
Please copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
  • Please disable AVG AntiSpyware by opening the program and on the Status page - beside "Resident Shield" click on "change status" so that it says "inactive" for it may interfere with our HJT fix.
    • Remember to reactivate this feature when all our work is finished.

  • Please RUN HijackThis

    1. Click the SCAN button to produce a log.


    2. Place a check mark beside each one of the following items:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank


    3. Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.


  • Now to Remove some malware:

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.
    2. Now copy/paste the entire content of the code box below into the Notepad window:

    File::
C:\WINDOWS\_MSRSTRT.EXE

Folder::
C:\Program Files\outlook


    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [external image: Posted Image]


    5. If the tool does not initiate a reboot itself, please restart the system yourself, then post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.

D. Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply, along with a fresh HijackThis log
Post #12
I don't have avg spyware. The only two programs that I have and use are xoftspy SE and NOadware. The Noaddware program, doesn't run any more since you had me delete some files earlier and an Noadware.exe file was one of them.
Post #13
NoAdware is on the undesirable list of programs. Believe me, you don't want that on your system. Please continue with the fix as described. Trevuren
Post #14
Here is the combofix log followed by the hijackthis log. I am now going to do the internet explorer part now and post the hijackthis log again.


ComboFix 07-08-10.8 - "ANN KLOPP" 2007-08-12 11:44:27.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.380 [GMT -5:00]
Command switches used :: C:\Documents and Settings\ANN KLOPP\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\_MSRSTRT.EXE


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\outlook
C:\WINDOWS\_MSRSTRT.EXE


((((((((((((((((((((((((( Files Created from 2007-07-12 to 2007-08-12 )))))))))))))))))))))))))))))))


2007-08-10 13:40 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-09 22:25 d——– C:\Program Files\Trend Micro
2007-08-09 22:15 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\AdobeAUM
2007-08-09 12:50 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Earthlink
2007-08-08 13:54 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\InstallShield
2007-08-08 13:43 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\ErrorSmart
2007-08-08 12:54 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\ErrorSmart
2007-08-08 11:22 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\EarthLink Toolbar
2007-08-08 11:05 d——– C:\Program Files\WinPoET Broadband Connection
2007-08-08 10:35 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\EarthLink Toolbar
2007-08-08 10:33 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Visual Networks
2007-08-08 10:23 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Earthlink
2007-08-07 17:32 d——– C:\DOCUME~1\Owner\APPLIC~1\EarthLink
2007-08-07 17:32 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\EarthLink
2007-08-07 17:31 d——– C:\Program Files\EarthLink
2007-08-04 15:12 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Symantec
2007-08-02 11:26 d——– C:\Program Files\XoftSpySE
2007-07-31 19:40 d——– C:\Temp


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-08 13:54 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-08 11:37 ——— d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Corel
2007-08-08 10:37 ——— d——– C:\Program Files\Common Files\EarthLink
2007-08-08 10:33 ——— d——– C:\Program Files\EarthLink TotalAccess
2007-07-02 15:48 ——— d——– C:\Program Files\Microsoft Picture It! PhotoPub
2007-06-29 19:13 ——— d——– C:\Program Files\iTunes
2007-06-23 10:27 ——— d——– C:\Program Files\TvInternet
2007-06-15 14:32 ——— d——– C:\Program Files\Apple Software Update
2007-05-16 10:12 86528 ——— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 10:12 85504 ——— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 10:12 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 10:12 683520 ——— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 10:12 510976 ——— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 10:12 1314816 ——— C:\WINDOWS\system32\dllcache\msoe.dll
2007-03-12 20:48 496 –a—— C:\Program Files\Common Files\quca
2005-01-12 20:55 37918 –a—— C:\Program Files\remove.exe
2003-02-05 12:41 207759 –a–c— C:\Program Files\INSTALL.LOG


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 08:59]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2003-02-05 12:36]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44]
"LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"IPInSightMonitor 01"="C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe" [2005-08-10 21:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-08 15:00]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 15:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Documents and Settings\ANN KLOPP\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2003-02-05 12:32:49]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-06-29 18:15:10]
MySoftware NewsFlash.lnk - C:\Program Files\Common Files\MySoftware\NewsFlsh.exe [2003-02-27 20:29:35]

R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMSM.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
S2 CoachCap;Concord EyeQ Duo 2000 USB Video Capture V1.00;C:\WINDOWS\system32\drivers\CoachCap.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys
S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys
S3 WrKPoET2000;WrKPoET2000;\??\C:\Program Files\WinPoET Broadband Connection\WrKPoET2000.sys


Contents of the 'Scheduled Tasks' folder
2007-04-21 13:54:33 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-08 18:43:56 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job - C:\Program Files\errorsmart\ErrorSmart.exe
2007-08-08 18:00:56 C:\WINDOWS\Tasks\XoftSpy.job - C:\Program Files\XoftSpy\XoftSpy.exe
2007-08-12 16:27:44 C:\WINDOWS\Tasks\XoftSpySE 2.job
2007-08-02 16:26:37 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-12 11:46:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000055d

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-12 11:47:34
C:\ComboFix-quarantined-files.txt … 2007-08-12 11:47
C:\ComboFix2.txt … 2007-08-10 20:48

— E O F —




HIJACKTHIS LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:52:09 AM, on 8/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE

–
End of file - 6365 bytes
Post #15
Hi, here is the K Scan report followed by a new hijackthis report


KASPERSKY ONLINE SCANNER REPORT
Sunday, August 12, 2007 2:00:12 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 12/08/2007
Kaspersky Anti-Virus database records: 379009
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 127279
Number of viruses found: 62
Number of infected objects: 295
Number of suspicious objects: 2
Duration of the scan process: 01:55:51

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\addd79150d220f5cdbc5787f81a8912c_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\13\1fea448d-2474d747/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\13\1fea448d-2474d747/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\13\1fea448d-2474d747/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\13\1fea448d-2474d747 ZIP: infected - 3 skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\26\2a68265a-72bd5c4b/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\26\2a68265a-72bd5c4b/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\26\2a68265a-72bd5c4b/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\6.0\26\2a68265a-72bd5c4b ZIP: infected - 3 skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-31a7d692-7c582e91.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-31a7d692-7c582e91.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-31a7d692-7c582e91.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-31a7d692-7c582e91.zip ZIP: infected - 3 skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-4c8d31dd-7e885313.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-4c8d31dd-7e885313.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-4c8d31dd-7e885313.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\ANN KLOPP\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\version.jar-4c8d31dd-7e885313.zip ZIP: infected - 3 skipped
C:\Documents and Settings\ANN KLOPP\install.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
C:\Documents and Settings\ANN KLOPP\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Local Settings\History\History.IE5\MSHist012007081220070813\index.dat Object is locked skipped
C:\Documents and Settings\ANN KLOPP\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\ANN KLOPP\nek.exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.ac skipped
C:\Documents and Settings\ANN KLOPP\nek.exe NSIS: infected - 1 skipped
C:\Documents and Settings\ANN KLOPP\ntuser.dat Object is locked skipped
C:\Documents and Settings\ANN KLOPP\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\ANN KLOPP\setup9x.exe Infected: Trojan-Downloader.Win32.VB.auk skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\mock\CPSFC.EXE/Data0012 Infected: not-a-virus:RiskTool.Win32.PsKill.1101 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\mock\CPSFC.EXE Wise: infected - 1 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\activate_crack.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Mostofate.e skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\activate_crack.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.e skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\activate_crack.exe NSIS: infected - 2 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0046.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0047.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0048.BIN/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0048.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0048.BIN/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0048.BIN/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.370 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0048.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0048.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0048.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe/WISE0049.BIN Infected: not-a-virus:AdWare.Win32.Relevant.a skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe WiseSFX: infected - 10 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe WiseSFX Dropper: infected - 10 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\sandboxofgod.exe/WISE0022.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\sandboxofgod.exe/WISE0023.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\sandboxofgod.exe/WISE0024.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\sandboxofgod.exe WiseSFX: infected - 3 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\ww2rescue.exe/WISE0468.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\ww2rescue.exe/WISE0469.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\ww2rescue.exe/WISE0470.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\ww2rescue.exe WiseSFX: infected - 3 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\activate_crack.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Mostofate.e skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\activate_crack.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.e skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\activate_crack.exe NSIS: infected - 2 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\CRACKS_AM - Page H2.htm Infected: Exploit.Win32.MS05-013.gen skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\dap53.exe/WISE0021.BIN/dapiebar.dll Infected: not-a-virus:AdWare.Win32.Dap.c skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\dap53.exe/WISE0021.BIN Infected: not-a-virus:AdWare.Win32.Dap.c skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\dap53.exe WiseSFX: infected - 2 skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\InsaniquariumDeluxeSetup-dm.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\New Folder (2)\SSRecSetup.exe/file8 Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\New Folder (2)\SSRecSetup.exe/file9 Infected: not-a-virus:AdWare.Win32.Relevant.a skipped
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\New Folder (2)\SSRecSetup.exe Inno: infected - 2 skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b104.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b104.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b104.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b104.exe NSIS: infected - 3 skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b122.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b136.exe/stream/data0002 Infected: Trojan-Dropper.Win32.Agent.bfr skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b136.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b136.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b136.exe NSIS: infected - 3 skipped
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer\Install Desktop Destroyer FREE.exe/data/App/1/SuperBarInstaller.exe Infected: not-a-virus:AdWare.Win32.GigatechSuperBar skipped
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer\Install Desktop Destroyer FREE.exe CAB: infected - 1 skipped
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer.zip/Install Desktop Destroyer FREE.exe/data/App/1/SuperBarInstaller.exe Infected: not-a-virus:AdWare.Win32.GigatechSuperBar skipped
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer.zip/Install Desktop Destroyer FREE.exe Infected: not-a-virus:AdWare.Win32.GigatechSuperBar skipped
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer.zip ZIP: infected - 2 skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6P89ABUV\user9[1].exe Infected: Trojan-Downloader.Win32.Small.dxm skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\EarthLink 5.0\[removed]\Cookies\index.dat Object is locked skipped
C:\Program Files\TvInternet\ActiveX\ads.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
C:\Program Files\TvInternet\ActiveX\ads0.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
C:\Program Files\TvInternet\ActiveX\ads1.exe Infected: Trojan-Downloader.Win32.IstBar.gen skipped
C:\Program Files\TvInternet\ads.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
C:\Program Files\TvInternet\ads0.exe Infected: Trojan-Downloader.Win32.Adload.jm skipped
C:\Program Files\TvInternet\ads1.exe Infected: Trojan-Downloader.Win32.IstBar.gen skipped
C:\Program Files\WinPoET Broadband Connection\WrOS.EventLog.txt Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\{30139~1\Bar888.dll.vir Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\QooBox\Quarantine\C\Program Files\NoAdware5.0\NoAdwareBackup\8,9,2007_13,15,45.zip.vir/!update.exe Suspicious: Password-protected-EXE skipped
C:\QooBox\Quarantine\C\Program Files\NoAdware5.0\NoAdwareBackup\8,9,2007_13,15,45.zip.vir ZIP: suspicious - 1 skipped
C:\QooBox\Quarantine\C\Program Files\SMANTE~1\javaw.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.ek skipped
C:\QooBox\Quarantine\C\WINDOWS\dls0523pmw.exe.vir Infected: Trojan-Downloader.Win32.Zlob.bqw skipped
C:\QooBox\Quarantine\C\WINDOWS\elpbn0578.exe.vir Infected: Trojan-Downloader.Win32.Small.dxm skipped
C:\QooBox\Quarantine\C\WINDOWS\kerknkb.exe.vir Infected: Trojan-Dropper.Win32.Agent.mu skipped
C:\QooBox\Quarantine\C\WINDOWS\kerknkbA.exe.vir Infected: Trojan-Downloader.Win32.VB.ang skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\dvxvdtbm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.lh skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\htdxujkg.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lawtjged.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\mffrwiag.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nojtiopr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pjgjtruy.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pwinsmdt.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ryciauqb.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tlhxjalu.exe.vir Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\urqronn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xpawhwrn.exe.vir Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\QooBox\Quarantine\catchme2007-08-10_141644.25.zip/core.sys Infected: Rootkit.Win32.Agent.eq skipped
C:\QooBox\Quarantine\catchme2007-08-10_141644.25.zip/awtqq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped
C:\QooBox\Quarantine\catchme2007-08-10_141644.25.zip/hggddda.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\QooBox\Quarantine\catchme2007-08-10_141644.25.zip ZIP: infected - 3 skipped
C:\RECYCLER\S-1-5-18\Dc1\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\RECYCLER\S-1-5-18\Dc10\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc11\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc12\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc13\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc14\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc15\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc16\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc17\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc18\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc19\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc20\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc21\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc22\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc23\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc24\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc25\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc26\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc27\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc4\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc5\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc6\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc7\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc8\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-18\Dc9\system.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\RECYCLER\S-1-5-21-418197387-1770863962-2433684469-1008\Dc10\ipwins.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138100.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138101.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138103.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138105.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138106.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138107.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138108.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138109.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138110.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138111.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138112.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138113.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138114.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138115.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138116.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138117.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138118.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138119.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138120.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138121.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138122.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138123.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138124.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138125.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138126.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138127.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138128.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138129.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138391.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP273\A0138392.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP297\A0142978.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP297\A0142979.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP297\A0143052.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP297\A0143061.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP301\A0143871.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP301\A0143881.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP301\A0143924.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0144579.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146655.exe Infected: Trojan-Downloader.Win32.Agent.bca skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146658.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.EZula.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146658.exe WiseSFX: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146659.exe Infected: not-a-virus:AdWare.Win32.BiSpy.r skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146661.dll Infected: not-a-virus:AdWare.Win32.BiSpy.o skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146673.dll Infected: not-a-virus:AdWare.Win32.Wintol.ao skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146675.exe Infected: not-a-virus:AdWare.Win32.Wintol.af skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146676.exe Infected: not-a-virus:AdWare.Win32.Wintol.af skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146677.exe Infected: not-a-virus:AdWare.Win32.Wintol.af skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146683.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146683.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP306\A0146683.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP307\A0146763.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP307\A0146765.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP307\A0146767.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP308\A0147927.exe Infected: Trojan-Downloader.Win32.PurityScan.eh skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0147967.exe Infected: Trojan-Downloader.Win32.Agent.ae skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0147974.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0147975.exe Infected: Trojan.Win32.Small.oa skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0148003.exe Infected: Trojan-Downloader.Win32.Agent.ae skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0148252.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0148253.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0148340.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP309\A0148341.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP314\A0150658.exe Infected: Trojan.Win32.Small.oa skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP314\A0150659.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP314\A0150709.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP314\A0150710.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP314\A0153011.exe Infected: Trojan.Win32.Small.oa skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP314\A0153012.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0153637.exe Infected: Trojan.Win32.Small.oa skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0153638.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0153755.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0153770.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0154840.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0154841.exe Infected: Trojan.Win32.Small.oa skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0154853.dll Infected: Trojan-Downloader.Win32.Small.dxm skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0154859.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0154859.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP315\A0154859.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154967.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154968.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154969.exe/data0002 Infected: not-a-virus:AdWare.Win32.Comet.c skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154969.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154970.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eh skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154970.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154988.exe Infected: Trojan-Downloader.Win32.PurityScan.eh skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0154990.exe Infected: Trojan-Downloader.Win32.PurityScan.eh skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155081.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155082.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155100.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155154.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155154.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155154.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155486.exe Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155487.dll Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155490.exe Infected: Trojan-Downloader.Win32.Agent.ae skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155495.exe Infected: Trojan-Downloader.Win32.TSUpdate.r skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155496.exe Infected: Trojan-Downloader.Win32.TSUpdate.f skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP316\A0155499.dll Infected: not-a-virus:AdWare.Win32.Comet.c skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP317\A0156967.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP320\A0157387.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP321\A0157712.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP321\A0157714.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP321\A0157715.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0157834.exe Infected: not-a-virus:AdWare.Win32.EZula.d skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0157835.exe Infected: Trojan-Downloader.Win32.Small.ezm skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158853.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158854.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158855.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158856.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158857.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158858.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158859.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158860.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP322\A0158861.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0158994.exe Infected: Trojan-Dropper.Win32.Agent.mu skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0158995.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0158996.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0158997.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0158999.exe Infected: Trojan-Downloader.Win32.Small.dxm skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159000.exe Infected: Trojan-Downloader.Win32.VB.ang skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159001.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lh skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159002.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159004.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159006.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159007.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159008.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159009.exe Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159013.exe Infected: Trojan-Downloader.Win32.PurityScan.ek skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159014.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159017.exe Infected: Trojan-Downloader.Win32.Zlob.bqw skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159031.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP324\A0159032.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159257.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159281.exe/WISE0014.BIN Infected: not-a-virus:AdWare.Win32.EZula.d skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159281.exe WiseSFX: infected - 1 skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159286.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159288.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159290.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159292.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159294.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159296.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159298.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159300.exe Infected: not-a-virus:AdWare.Win32.Mostofate.aj skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159301.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159303.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159305.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159307.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159309.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159311.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159313.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159315.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159317.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159319.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159321.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159323.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159325.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159327.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159329.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159331.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159333.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159336.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159339.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159341.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159343.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159345.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159347.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159349.dll Infected: not-a-virus:AdWare.Win32.Mostofate.ac skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159367.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159368.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP325\A0159369.dll Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP326\change.log Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB833330$\Blastcln\blastcln.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\xpsp2res.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Downloaded Program Files\speedtest.dll Infected: not-a-virus:Downloader.Win32.InsTool.a skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



Hi, here is the new hijackthis report

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:01:02 PM, on 8/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE

–
End of file - 6498 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI