Tech Support Forum - View Single Post - Download.Trojen, Backdoor.Tofger + popups and more!

mookoo · 03-07-2006, 05:02 PM

Here are the logs:

Kapersky:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, March 07, 2006 11:59:02 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 8/03/2006
Kaspersky Anti-Virus database records: 180733
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 68384
Number of viruses found: 22
Number of infected objects: 35
Number of suspicious objects: 0
Duration of the scan process: 00:51:52

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip ZIP: infected - 3 skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-3e4afc88.zip/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-3e4afc88.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-3e4afc88.zip ZIP: infected - 2 skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-37432f94.zip/javainstaller/InstallerApplet.class Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-37432f94.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip ZIP: infected - 3 skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022525.exe/run.exe Infected: Trojan-Downloader.Win32.Small.ckj skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022525.exe ZIP: infected - 1 skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022554.exe Infected: not-virus:Hoax.Win32.Renos.al skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022555.exe Infected: Trojan-Downloader.Win32.VB.ya skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022559.exe Infected: Trojan-Clicker.Win32.VB.li skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022571.exe Infected: not-virus:Hoax.Win32.Renos.al skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022573.exe Infected: Trojan-Downloader.Win32.Tiny.al skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022581.exe Infected: Trojan-Dropper.Win32.Small.qn skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022582.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022591.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022592.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022593.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022606.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022624.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022639.DLL Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022643.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022984.dll Infected: Trojan-Spy.Win32.Agent.kc skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022985.dll Infected: Trojan-Spy.Win32.Gepost.m skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022986.dll Infected: Trojan-PSW.Win32.Agent.eu skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022987.exe Infected: Trojan-Downloader.Win32.Adload.w skipped
C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022989.dll Infected: Trojan-Downloader.Win32.Agent.afl skipped
C:\WINDOWS\system32\win_84.exe Infected: Trojan-Downloader.Win32.Agent.aga skipped

Scan process completed.

Ewido:

File: syst6l7.dll
Status:
POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). This might be a false positive. Therefore, results of this scan will not be stored in the database)
MD5 9e71a82ca43583e9adee378764365cb9
Packers detected:
-
Scanner results
BitDefender
Found Trojan.Downloader.Small.Gen (probable variant)

(I removed the other scanner results as they did not contain anything)

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 23:59:29, on 07/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime Alternative\qttask.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Ovulation Calendar\OVUCAL.EXE
C:\Program Files\Rainlendar\Rainlendar.exe
C:\WINDOWS\system32\regsvr32.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe

O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Ovulation Calendar.lnk = C:\Program Files\Ovulation Calendar\OVUCAL.EXE
O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1129163372156
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\syst6l7.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

03-07-2006, 05:02 PM	#5 (permalink)
mookoo Registered User Join Date: Mar 2006 Location: Edinburgh Posts: 20 OS: WinXP Pro SP2	Here are the logs: Kapersky: ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Tuesday, March 07, 2006 11:59:02 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.78.0 Kaspersky Anti-Virus database last update: 8/03/2006 Kaspersky Anti-Virus database records: 180733 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 68384 Number of viruses found: 22 Number of infected objects: 35 Number of suspicious objects: 0 Duration of the scan process: 00:51:52 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-3b347171-471b9aad.zip ZIP: infected - 3 skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-3e4afc88.zip/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-3e4afc88.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-3e4afc88.zip ZIP: infected - 2 skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-37432f94.zip/javainstaller/InstallerApplet.class Infected: Trojan-Downloader.Java.OpenStream.w skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-37432f94.zip ZIP: infected - 1 skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip/Counter.class Infected: Trojan.Java.ClassLoader.h skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip/Parser.class Infected: Trojan.Java.ClassLoader.d skipped C:\Documents and Settings\Mookoo\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-e18f163-1f26c556.zip ZIP: infected - 3 skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022525.exe/run.exe Infected: Trojan-Downloader.Win32.Small.ckj skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022525.exe ZIP: infected - 1 skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022554.exe Infected: not-virus:Hoax.Win32.Renos.al skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022555.exe Infected: Trojan-Downloader.Win32.VB.ya skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022559.exe Infected: Trojan-Clicker.Win32.VB.li skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022571.exe Infected: not-virus:Hoax.Win32.Renos.al skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022573.exe Infected: Trojan-Downloader.Win32.Tiny.al skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022581.exe Infected: Trojan-Dropper.Win32.Small.qn skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022582.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022591.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022592.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022593.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP190\A0022606.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022624.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022639.DLL Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022643.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022984.dll Infected: Trojan-Spy.Win32.Agent.kc skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022985.dll Infected: Trojan-Spy.Win32.Gepost.m skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022986.dll Infected: Trojan-PSW.Win32.Agent.eu skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022987.exe Infected: Trojan-Downloader.Win32.Adload.w skipped C:\System Volume Information\_restore{E855FA79-61BF-41EA-BF90-80501B6BD95C}\RP191\A0022989.dll Infected: Trojan-Downloader.Win32.Agent.afl skipped C:\WINDOWS\system32\win_84.exe Infected: Trojan-Downloader.Win32.Agent.aga skipped Scan process completed. Ewido: File: syst6l7.dll Status: POSSIBLY INFECTED/MALWARE (Note: this file was only flagged as malware by heuristic detection(s). This might be a false positive. Therefore, results of this scan will not be stored in the database) MD5 9e71a82ca43583e9adee378764365cb9 Packers detected: - Scanner results BitDefender Found Trojan.Downloader.Small.Gen (probable variant) (I removed the other scanner results as they did not contain anything) HJT: Logfile of HijackThis v1.99.1 Scan saved at 23:59:29, on 07/03/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\ASUS\Probe\AsusProb.exe C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\QuickTime Alternative\qttask.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\system32\Wtablet\TabUserW.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Ovulation Calendar\OVUCAL.EXE C:\Program Files\Rainlendar\Rainlendar.exe C:\WINDOWS\system32\regsvr32.exe C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe C:\Program Files\Netropa\Onscreen Display\OSD.exe C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\Network Associates\VirusScan\Avconsol.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\HJT\HijackThis.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1 O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Ovulation Calendar.lnk = C:\Program Files\Ovulation Calendar\OVUCAL.EXE O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1129163372156 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - AppInit_DLLs: C:\WINDOWS\system32\syst6l7.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe