[Resolved] Help! Trojan with many IE popups and HJT log

Hello!! I'm not sure if this message has been missed, but we really need to get our system back up and running. Any help would be appreciated Thanks

Hello

Please download Runscanner to your desktop and run it.

• When the first page comes up select Beginner Mode
• On the next page select Save a binary .Run file (Recommended) then click Start full scan at the top.
• At this time Runscanner.exe may request access to the Internet through your firewall please allow it to do so, it will then run for two or three minutes.
• On completion it will ask for a location to save the file and a name. It will do this for both the .run file and the log file
• Call the .run file "runscan" and save it to your desktop. You will see the .run file on your desktop. Please zip the .run file by right clicking and selecting send to Zip file

Then upload that as an attachment in your next post (you have to zip the .run file to upload it here).

Thanks for the response. Here is the zipped runscan file as requested.

Hello

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Hi Rorschach112 The Kaspersky Webscanner Keeps failing on the update. Says I need to be connected to the internet and update the files, however I am connected. I have restarted the computer and get the same error. Any suggestions??

Do this

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
• Click Scan (This scan can take several hours, so please be patient)
• Once the scan is completed, you may close the window
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic

Hi, Sorry for the delay in response, had to run to work for a few hours…I've tried to run the ESET ONLINE scanner, however it continues to tell me 'ERROR: Cannot initialize Onlinescanner. Administrator rights required.' However, I am the administrator and DO have administrator rights and I did go to my user accounts and verify this. Once again I have restarted the system and still get the same error. Could it have something to do with Vista?

Do this, make sure to right click and run it as admin

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Hi Rorschach112, No Restart was prompted and here is the result of the scan. Malwarebytes' Anti-Malware 1.19 Database version: 920 Windows 6.0.6001 Service Pack 1 9:30:04 AM 04/07/2008 mbam-log-7-4-2008 (09-30-04).txt Scan type: Quick Scan Objects scanned: 36424 Time elapsed: 3 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Your logs are clean

• Make sure you have an Internet Connection.
• Download OTCleanIt to your desktop and run it
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
• Click Yes to beging the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here




Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

Hi Thank you for your help. However, I retried the Kaspersky antiviurus and it said it found a virus. I have included the log in this reply. Should I be concerned about this report? ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Saturday, July 05, 2008 10:48:24 AM Operating System: Microsoft Windows Vista Home Edition, Service Pack 1 (Build 6001) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 5/07/2008 Kaspersky Anti-Virus database records: 915351 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan Statistics: Total number of scanned objects: 201456 Number of viruses found: 1 Number of infected objects: 1 Number of suspicious objects: 0 Duration of the scan process: 03:06:07 Infected Object Name / Virus Name / Last Action C:\Program Files\PC-Doctor 5 for Windows\Configuration\config.xml Object is locked skipped C:\ProgramData\avg8\Log\avgcore.log Object is locked skipped C:\ProgramData\avg8\Log\avgrs.log Object is locked skipped C:\ProgramData\avg8\Log\avgsched.log Object is locked skipped C:\ProgramData\avg8\Log\avgui.log Object is locked skipped C:\ProgramData\avg8\Log\avgwd.log Object is locked skipped C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6754300e87e0f6f97a37c54ac9fdee17_01021e99-a8f8-4c6c-8db0-4e0f87a38d4c Object is locked skipped C:\ProgramData\muvee Technologies\030625\0103\0399\values Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008070420080705\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008070520080706\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS0002.tmp Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\UsrClass.dat{b7019093-479a-11dc-89fa-001bfc7e9b98}.TM.blf Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\UsrClass.dat{b7019093-479a-11dc-89fa-001bfc7e9b98}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows\UsrClass.dat{b7019093-479a-11dc-89fa-001bfc7e9b98}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Outlook\archive.pst Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Outlook\Outlook.pst Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows Defender\FileTracker\{46B8FCA0-55E9-4606-95B0-4F5EB0280E79} Object is locked skipped C:\Users\Lidstones\AppData\Local\Microsoft\Windows Sidebar\Settings.ini Object is locked skipped C:\Users\Lidstones\AppData\Local\Temp\JET31C9.tmp Object is locked skipped C:\Users\Lidstones\AppData\Local\Temp\logger.log Object is locked skipped C:\Users\Lidstones\AppData\Local\Temp\Low\~DF797F.tmp Object is locked skipped C:\Users\Lidstones\AppData\Local\Temp\Low\~DF79B8.tmp Object is locked skipped C:\Users\Lidstones\AppData\Local\Temp\MainFrame.Log.txt Object is locked skipped C:\Users\Lidstones\AppData\Local\Temp\~DF3996.tmp Object is locked skipped C:\Users\Lidstones\AppData\Local\Temp\~DF42DA.tmp Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Hewlett-Packard\HPAdvisor\HPAdvisorToDo.ldb Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Hewlett-Packard\HPAdvisor\HPAdvisorToDo.mdb Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Microsoft\ActiveSync\Profiles\7f7b775e\repl.dat Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Microsoft\ActiveSync\Profiles\7f7b775e\user.sdf Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Microsoft\Outlook\Outlook.srs Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Microsoft\Templates\Normal.dot Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat Object is locked skipped C:\Users\Lidstones\AppData\Roaming\Snapfish\Client\Log\detector.log Object is locked skipped C:\Users\Lidstones\NTUSER.DAT Object is locked skipped C:\Users\Lidstones\ntuser.dat.LOG1 Object is locked skipped C:\Users\Lidstones\ntuser.dat.LOG2 Object is locked skipped C:\Users\Lidstones\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped C:\Users\Lidstones\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped C:\Users\Lidstones\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped C:\Windows\bthservsdp.dat Object is locked skipped C:\Windows\Debug\PASSWD.LOG Object is locked skipped C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped C:\Windows\Logs\CBS\CBS.log Object is locked skipped C:\Windows\Logs\CBS\CBS.persist.log Object is locked skipped C:\Windows\Logs\DPX\setupact.log Object is locked skipped C:\Windows\Logs\DPX\setuperr.log Object is locked skipped C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config Object is locked skipped C:\Windows\Panther\UnattendGC\diagerr.xml Object is locked skipped C:\Windows\Panther\UnattendGC\diagwrn.xml Object is locked skipped C:\Windows\Panther\UnattendGC\setupact.log Object is locked skipped C:\Windows\Panther\UnattendGC\setuperr.log Object is locked skipped C:\Windows\security\database\secedit.sdb Object is locked skipped C:\Windows\SoftwareDistribution\EventCache\{5863BB34-CA0A-49FD-AFAD-50DD9F5C3055}.bin Object is locked skipped C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped C:\Windows\System32\catroot2\edb.log Object is locked skipped C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped C:\Windows\System32\LogFiles\WindowsMobile\WcesLog.etl.001 Object is locked skipped C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\Windows\System32\restore\MachineGuid.txt Object is locked skipped C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped C:\Windows\System32\sysprep\Panther\diagerr.xml Object is locked skipped C:\Windows\System32\sysprep\Panther\diagwrn.xml Object is locked skipped C:\Windows\System32\sysprep\Panther\setupact.log Object is locked skipped C:\Windows\System32\sysprep\Panther\setuperr.log Object is locked skipped C:\Windows\System32\wbem\AutoRecover\0296C47314AB746EC35476488248FCD9.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\040270F850D5C3C91057DDDA2DA294D8.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\0A9DBC92D554324656F61F9862679F27.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\0DF617D6737A7561E732F853792261C3.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\1E2E58C73053C7775EB226DB5E739137.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\26C097A9392F8C541AD42E89B7909073.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2A811E5CCC22CC9D7AE2B04EF0402688.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2AA23BB86A5EBD8BC2D820944E55B233.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2CE523184A801AA7361A7039E2D6B41D.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\2D57A7682ACD19214C258D31A06D008F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\3460B7617E0429A960E481B197F238A3.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\376786241A5443E41378D25CF812FCC1.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\3DC0BABDCA20E5E319117C21BD4BD795.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\494C62FAA08CD5217399BAA555FF491B.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\4A01E0F376B5833EBA98F0D1D5F60CD1.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\4B471F64BAF831EC7945C820FD5A16E5.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\4CB32C0A77CD4D9B0C9618F73F786C32.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\5774C77265BE4C55B5C6C9718979E015.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\5966D45C7B25EACA46E87DD8E5703964.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\5B5D21CF62E70BACF9D085E6AA6CE143.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\69554D930FCA40B0304B9A43A8036F2D.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\72F867EF62976CE9F70993FF3E68A4EB.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\75054C3771DF289038069A9BB1C1FB6E.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\7851AF96EA828F912853F32DB0D96138.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\7F417E1A6D819A9B2FEB55DA6858EA0A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\87AA2A001CE3E89926688B93E4DC2992.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\8A94AF24F162D580E3D9889344A3A317.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\8C718B5AFD373885B68D2836088CAF9A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\903E49C444C46FEF5F2C3A189C9CEF71.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\96ABB1671705F680578FE240427CBD4F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9A72EE7775E8021F75961342B8AFD1B4.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9AD3182A2F39A3E091E15109132EC6CC.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9CD33F0956942860B50AA1B9330DEFAF.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\9E06E4FE97F0CBB8D659894823F805D7.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\A80FF2DC09487ECD60AFB147B262BDD7.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\AA6E0E396C238977CA909EFD82299737.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\AA742824DCADA846BA4B665D686DD5D6.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\BBF206490BAA431B592F9A13534F43F6.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\BE81B2C0741907C1FC1C42B6223E59AD.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\D1A1B12A7DA3F9675C01397A26DBF4B3.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\D4C4BA54B6A8FA6211E60E2ADFF7426A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\DE391013DA56ABA39FFF40A9ABDF052F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\DF80FD3849FFF74B4BF43E2EA8ADEC8A.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\DFB9AD54AC2D3B8122567AAD3BF3EB7F.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\E04DE4CDFEC284A342159BB920976701.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\E478A5DB75C9721E744C05D78DBACFD3.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\E737DE61441445E1FDFCA45EF5E7D987.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\E9D8A460B2C986DD5FF19F299F4A27EC.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\EC45C70F2A3D9DED718E71631C38E2FE.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\F01326692CC5736EBAC31B9FC2381CF2.mof Object is locked skipped C:\Windows\System32\wbem\AutoRecover\F81E6BEBC3067C406E6C491608474198.mof Object is locked skipped C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped C:\Windows\System32\wbem\Repository\INDEX.BTR Object is locked skipped C:\Windows\System32\wbem\Repository\MAPPING1.MAP Object is locked skipped C:\Windows\System32\wbem\Repository\MAPPING2.MAP Object is locked skipped C:\Windows\System32\wbem\Repository\OBJECTS.DATA Object is locked skipped C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DateTimeControlPanel%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PLA%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Networking%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnostic%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Forwarding%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Help%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WDI%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ParentalControls%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Metrics.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wired-AutoConfig%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\Setup.evtx Object is locked skipped C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job Object is locked skipped C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped C:\Windows\WindowsUpdate.log Object is locked skipped C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6000.16386_none_cef7ceb03914a67f\dnary.xsd Object is locked skipped C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6001.18000_none_d12e90ac35ffb753\dnary.xsd Object is locked skipped E:\desktop.ini Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\ALBUM.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\ALBUM0.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\ARTIST.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\ARTIST0.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\ARTIST1.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\ARTIST2.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\AUDIOCD.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\AUDIOCD.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\DISK.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\DISK1.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\DISK2.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\GENRE.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\GENRE0.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\GENRE1.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\GENRE2.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\MUSIC.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\MUSIC.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\PLAYLIST.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\PLAYLIST.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\PLLABEL.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\PLLABEL.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\SMPL.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\SMPL.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\VIDEOCD.CDX Object is locked skipped E:\Documents and Settings\All Users\Application Data\Creative\Media Database\Backup\VIDEOCD.DBF Object is locked skipped E:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\DSS\MachineKeys\c74c6f795ada87022536668c055d2c0e_fdf28028-b7f8-4a9a-8ca1-2cf6c2358418 Object is locked skipped E:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped E:\Program Files\InstallShield Installation Information\{0552A36D-0D7E-4FF5-8FDB-6629ABA7C779}\Setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{0A7B28CF-6BE3-11D6-A285-00A0CC51B2FE}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{0DEA94ED-915A-4834-A87E-388D012C8E02}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{3CB41017-F5CA-4C56-934C-ED02156251E6}\Setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{3F5C4C80-1FA7-11D4-B333-E7021860665A}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{47808F78-F178-49DC-B708-15FE538B16FF}\Setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{48E3A9E6-FA13-11D5-8CC9-00A0C98192B6}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{53337CA9-E9A4-4C59-9D1C-D980EF9BF0C2}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{B8D0BC3E-67DF-48A3-ACC9-EEAA8DBFBF29}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{B97CF5C3-0487-11D8-A36E-0050BAE317E1}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{DDE5437B-7DC2-4BB4-BECA-B5E7633259D0}\setup.ilg Object is locked skipped E:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.ilg Object is locked skipped E:\Program Files\QT2005\inet\qt2005_221.dll Object is locked skipped E:\QuickTax 2004\QT2004\inet\qt2004_206.dll Object is locked skipped E:\WINDOWS\Debug\UserMode\userenv.bak Object is locked skipped E:\WINDOWS\Debug\UserMode\userenv.log Object is locked skipped E:\WINDOWS\repair\autoexec.nt Object is locked skipped E:\WINDOWS\repair\config.nt Object is locked skipped E:\WINDOWS\repair\default Object is locked skipped E:\WINDOWS\repair\ntuser.dat Object is locked skipped E:\WINDOWS\repair\sam Object is locked skipped E:\WINDOWS\repair\secsetup.inf Object is locked skipped E:\WINDOWS\repair\security Object is locked skipped E:\WINDOWS\repair\setup.log Object is locked skipped E:\WINDOWS\repair\software Object is locked skipped E:\WINDOWS\repair\system Object is locked skipped E:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped E:\WINDOWS\system32\config\default Object is locked skipped E:\WINDOWS\system32\config\default.LOG Object is locked skipped E:\WINDOWS\system32\config\default.sav Object is locked skipped E:\WINDOWS\system32\config\default.tmp.LOG Object is locked skipped E:\WINDOWS\system32\config\SAM Object is locked skipped E:\WINDOWS\system32\config\SAM.LOG Object is locked skipped E:\WINDOWS\system32\config\sam.sav Object is locked skipped E:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped E:\WINDOWS\system32\config\SECURITY Object is locked skipped E:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped E:\WINDOWS\system32\config\security.sav Object is locked skipped E:\WINDOWS\system32\config\software Object is locked skipped E:\WINDOWS\system32\config\software.LOG Object is locked skipped E:\WINDOWS\system32\config\software.sav Object is locked skipped E:\WINDOWS\system32\config\software.tmp.LOG Object is locked skipped E:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped E:\WINDOWS\system32\config\system Object is locked skipped E:\WINDOWS\system32\config\system.LOG Object is locked skipped E:\WINDOWS\system32\config\system.sav Object is locked skipped E:\WINDOWS\system32\config\system.tmp.LOG Object is locked skipped E:\WINDOWS\system32\config\TempKey.LOG Object is locked skipped E:\WINDOWS\system32\config\userdiff Object is locked skipped E:\WINDOWS\system32\config\userdiff.LOG Object is locked skipped E:\WINDOWS\system32\iu8eum4a.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao skipped E:\WINDOWS\Tasks\{2091E039-C550-4FB3-8B4F-3C79E814D9CF}_LIDSTONE_Chris.job Object is locked skipped E:\WINDOWS\Tasks\{4BFE45D3-1CE6-4991-9ECF-915288FB9A55}_LIDSTONE_Chris.job Object is locked skipped E:\WINDOWS\Tasks\{FA12AE14-C67F-43F2-A995-06E52301E89D}_LIDSTONE_Chris.job Object is locked skipped Scan process completed.

Go and delete this file

E:\WINDOWS\system32\iu8eum4a.ini


Then we are done