Hi again,
This is going to be a long post!
1 - I deleted the 2 viewpoint programs you mentionned, as well as Bearshare. I did not delete Bitcomet because it is listed as 'clean' on the link you posted above.
2 - For some reason, Pandascan stopped scanning when it was 1/5th done. I tried it twice (Avast was completely turned off) and it still stopped at the exact place. Just in case this will help, I've added 'where' the scanner stopped both times:
27644 Files scanned ...r[2007_06_12\ZbThumbnail.info]
However, it did give me a report for the portion it did scan. See below:
Incident Status Location
Adware:adware/savenow Not disinfected c:\program files\VVSN
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8z0nki0u.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8z0nki0u.default\cookies.txt[landing.domainsponsor.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8z0nki0u.default\cookies.txt[.zedo.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.112.2o7.net/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.advertising.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.anm.co.uk/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.com.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/Linksynergy Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.linksynergy.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.overture.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.go.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.bravenet.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[statse.webtrendslive.com/S142313]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.perf.overture.com/]
Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.adviva.net/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.adserver.easyad.info/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[
www.burstbeacon.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Danna\Application Data\Mozilla\Firefox\Profiles\wbil0mdg.default\cookies.txt[server.iad.liveperson.net/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Danna\Cookies\administrator@adtech[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Danna\Cookies\administrator@atdmt[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Danna\Cookies\administrator@burstnet[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Danna\Cookies\administrator@com[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Danna\Cookies\administrator@doubleclick[2].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Danna\Cookies\danna@247realmedia[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Danna\Cookies\danna@ad.yieldmanager[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Danna\Cookies\danna@adrevolver[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Danna\Cookies\danna@adrevolver[3].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Danna\Cookies\danna@ads.pointroll[2].txt
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Danna\Cookies\danna@adserver.easyad[1].txt
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Danna\Cookies\danna@adtech[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Danna\Cookies\danna@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Danna\Cookies\danna@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Danna\Cookies\danna@atwola[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Danna\Cookies\danna@bluestreak[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Danna\Cookies\danna@bs.serving-sys[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Danna\Cookies\danna@burstnet[2].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Danna\Cookies\danna@casalemedia[2].txt
Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Danna\Cookies\danna@citi.bridgetrack[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Danna\Cookies\danna@com[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Danna\Cookies\danna@doubleclick[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Danna\Cookies\danna@fastclick[2].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Danna\Cookies\danna@mediaplex[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Danna\Cookies\danna@overture[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Danna\Cookies\danna@questionmarket[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Danna\Cookies\danna@realmedia[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Danna\Cookies\danna@serving-sys[1].txt
Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Danna\Cookies\danna@stat.onestat[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Danna\Cookies\danna@statcounter[2].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Danna\Cookies\danna@statse.webtrendslive[2].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Danna\Cookies\danna@tradedoubler[2].txt
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Danna\Cookies\danna@trafficmp[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Danna\Cookies\danna@tribalfusion[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Danna\Cookies\danna@zedo[2].txt
Do you have any idea why the Panda-scan stops at the same place both times? Is there something I can do to get a 100% scan?
Here is the Hijackthis log file:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:36:49 AM, on 12/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Danna\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.ca/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Vbuzzer RSS list - C:\Program Files\vbuzzer\addurl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://gfx1.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -
http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://messenger.zone.msn.com/binary...o.cab32846.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
--
End of file - 7173 bytes
I have also attached Avast’s scan results. One infection was file, seems like it might be a system file…please see attached. Should I delete it from the virus chest?