Good Morning
I still could not get the kaspersky scan to work however the bit defender did. Here are the 2 logs you have requested:
BitDefender Online Scan Log:-
BitDefender Online Scanner
Scan report generated at: Sun, Jul 01, 2007 - 13:47:32
Scan path: C:\;D:\;
Statistics
Time
00:34:34
Files
130396
Folders
4455
Boot Sectors
3
Archives
7372
Packed Files
7807
Results
Identified Viruses
2
Infected Files
11
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
0
Engines Info
Virus Definitions
636162
Engine build
AVCORE v1.0 (build 2410) (i386) (Jun 12 2007 21:08:27)
Scan plugins
14
Archive plugins
38
Unpack plugins
6
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Report
Second Action
None
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
C:\Documents and Settings\All Users\Application Data\ADMINDARTSETTINGSONLINE\knob long.exe
Infected with: Trojan.FatObfus.Gen
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\273262A2.exe=>(Quarantine-2)
Infected with: Trojan.FatObfus.Gen
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29494854.exe=>(Quarantine-2)
Infected with: Trojan.FatObfus.Gen
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A8306FB.exe=>(Quarantine-2)
Infected with: Trojan.FatObfus.Gen
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2C2B5928.exe=>(Quarantine-2)
Infected with: Trojan.FatObfus.Gen
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\509B1540.exe=>(Quarantine-2)
Infected with: Trojan.FatObfus.Gen
C:\QooBox\Quarantine\C\DOCUME~1\halinka\APPLIC~1\FLAWMP~1\zaicfiyi.exe.vir
Infected with: Trojan.FatObfus.Gen
C:\System Volume Information\_restore{4BF2C15B-24E1-4387-A592-E87432727BAE}\RP2\A0001145.exe
Infected with: Trojan.FatObfus.Gen
C:\WINDOWS\system32\drivers\etc\1.hosts
Infected with: Generic.Qhost.9AFCC303
C:\WINDOWS\system32\drivers\etc\2.hosts
Infected with: Generic.Qhost.9AFCC303
C:\WINDOWS\system32\drivers\etc\3.hosts
Infected with: Generic.Qhost.9AFCC303
and ComboFix log:-
"halinka" - 2007-06-30 23:53:40 - ComboFix 07-07-01 - Service Pack 2 NTFS
Command switches used :: D:\ComboFix-Do.txt
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Documents and Settings\halinka\Start Menu\Programs\Startup\lsass.lnk
C:\WINDOWS\system32\pgfyzk
C:\WINDOWS\system32\pgfyzk\lsass.ini
((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-30 )))))))))))))))))))))))))))))))
2007-06-30 21:34 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-30 20:06 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Yahoo!
2007-06-30 16:57 <DIR> d-------- C:\Program Files\Hijack This
2007-06-30 15:47 <DIR> d-------- C:\Program Files\Lavasoft
2007-06-30 15:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-30 15:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-30 10:06 <DIR> d-------- C:\Ikarus
2007-06-30 08:45 385,024 --a------ C:\WINDOWS\system32\IKAutoUp.exe
2007-06-30 08:45 385,024 --a------ C:\WINDOWS\system32\IkAutoUp.dat
2007-06-29 19:52 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-06-29 19:43 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2007-06-29 17:07 <DIR> d-------- C:\Program Files\Browser Hijack Recover
2007-06-27 21:04 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-06-27 20:55 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Yahoo!
2007-06-27 20:22 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\Yahoo!
2007-06-27 20:19 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\Google
2007-06-27 19:34 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\Prevx
2007-06-26 22:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
2007-06-26 20:35 <DIR> d-------- C:\DOCUME~1\halinka\APPLIC~1\Prevx
2007-06-26 20:32 77,312 --a------ C:\WINDOWS\ua2.dll
2007-06-25 23:39 1,835,008 --ah----- C:\DOCUME~1\tracy\NTUSER.DAT
2007-06-25 23:39 <DIR> d-------- C:\DOCUME~1\tracy\WINDOWS
2007-06-25 23:39 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\Teleca
2007-06-25 23:39 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\Symantec
2007-06-25 23:39 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\Sony Ericsson
2007-06-25 23:39 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\SampleView
2007-06-25 23:39 <DIR> d-------- C:\DOCUME~1\tracy\APPLIC~1\Help
2007-06-25 22:25 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-06-25 21:36 <DIR> d-------- C:\DOCUME~1\halinka\APPLIC~1\Yahoo!
2007-06-25 21:35 86,016 --a------ C:\WINDOWS\system32\YPcservice.exe
2007-06-25 21:35 131,072 --a------ C:\WINDOWS\system32\ypclsp.dll
2007-06-25 21:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
2007-06-25 21:30 <DIR> d-------- C:\Program Files\Common Files\Motive
2007-06-25 19:19 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-06-25 19:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\yahoo!
2007-06-25 19:18 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
2007-06-25 19:18 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2007-06-25 19:18 <DIR> d-------- C:\Program Files\Yahoo!
2007-06-25 19:17 <DIR> d-------- C:\WINDOWS\Motive
2007-06-25 19:17 <DIR> d-------- C:\Program Files\btbb_wcm
2007-06-25 19:16 947,472 --a------ C:\WINDOWS\system32\msjava.dll
2007-06-25 19:16 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll
2007-06-25 19:16 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-06-25 19:16 49,424 --a------ C:\WINDOWS\system32\clspack.exe
2007-06-25 19:16 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-06-25 19:16 404,752 --a------ C:\WINDOWS\system32\javart.dll
2007-06-25 19:16 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-06-25 19:16 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll
2007-06-25 19:16 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2007-06-25 19:16 187,152 --a------ C:\WINDOWS\system32\javacypt.dll
2007-06-25 19:16 172,304 --a------ C:\WINDOWS\system32\jview.exe
2007-06-25 19:16 171,792 --a------ C:\WINDOWS\system32\wjview.exe
2007-06-25 19:16 171,280 --a------ C:\WINDOWS\system32\jit.dll
2007-06-25 19:16 154,384 --a------ C:\WINDOWS\system32\msawt.dll
2007-06-25 19:16 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2007-06-25 19:16 113 --a------ C:\WINDOWS\system32\zonedon.reg
2007-06-25 19:16 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2007-06-25 19:16 <DIR> d-------- C:\Program Files\Motive
2007-06-25 19:16 <DIR> d-------- C:\Program Files\BT Home Hub
2007-06-12 20:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-06-11 13:20 <DIR> d-------- C:\Program Files\MySpace
2007-06-11 13:20 <DIR> d-------- C:\DOCUME~1\halinka\APPLIC~1\MySpace
2007-06-11 09:46 <DIR> d-------- C:\DOCUME~1\halinka\APPLIC~1\Leadertech
2007-06-04 15:18 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 15:14 6,272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-03 15:06 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-06-03 15:06 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-06-03 15:06 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-06-03 15:06 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-06-03 15:06 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-06-03 15:06 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-06-03 15:06 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-06-03 15:05 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-06-03 15:04 98,304 --a------ C:\WINDOWS\system32\rsnpstd.dll
2007-06-03 15:04 61,440 --a------ C:\WINDOWS\system32\csnpstd.dll
2007-06-03 15:04 53,248 --a------ C:\WINDOWS\system32\dsnpstd.dll
2007-06-03 15:04 390,912 --a------ C:\WINDOWS\system32\drivers\snpstd.sys
2007-06-03 15:04 36,864 --a------ C:\WINDOWS\system32\vsnpstd.dll
2007-06-03 15:04 286,720 --a------ C:\WINDOWS\vsnpstd.exe
2007-06-03 15:04 <DIR> d-------- C:\WINDOWS\Album
2007-06-03 15:04 <DIR> d-------- C:\Program Files\VideoCAM Trek
2007-06-03 15:04 <DIR> d-------- C:\Program Files\Common Files\VCAMTrek
2007-05-30 23:43 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-30 23:41 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-05-30 14:01 94,064 -ra------ C:\WINDOWS\system32\drivers\k510mdm.sys
2007-05-30 14:01 8,336 -ra------ C:\WINDOWS\system32\drivers\k510mdfl.sys
2007-05-30 14:01 6,176 -ra------ C:\WINDOWS\system32\drivers\k510cmnt.sys
2007-05-30 14:01 6,176 -ra------ C:\WINDOWS\system32\drivers\k510cm.sys
2007-05-30 14:01 58,288 -ra------ C:\WINDOWS\system32\drivers\k510bus.sys
2007-05-30 14:01 5,808 -ra------ C:\WINDOWS\system32\drivers\k510whnt.sys
2007-05-30 14:01 5,808 -ra------ C:\WINDOWS\system32\drivers\k510wh.sys
2007-05-30 13:59 <DIR> d--hs---- C:\RECYCLER
2007-05-30 13:39 <DIR> d-------- C:\DOCUME~1\halinka\APPLIC~1\AdobeUM
2007-05-30 13:39 <DIR> d-------- C:\DOCUME~1\halinka\APPLIC~1\AdobeAUM
2007-05-30 13:33 90,800 -ra------ C:\WINDOWS\system32\drivers\se2Cunic.sys
2007-05-30 13:33 4,128 -ra------ C:\WINDOWS\system32\drivers\se2Ccr.sys
2007-05-30 13:33 18,704 -ra------ C:\WINDOWS\system32\drivers\se2Cnd5.sys
2007-05-30 13:32 97,184 -ra------ C:\WINDOWS\system32\drivers\SE2Cmdm.sys
2007-05-30 13:32 9,360 -ra------ C:\WINDOWS\system32\drivers\SE2Cmdfl.sys
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-29 15:57:38 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-27 00:57:52 60 ----a-w C:\WINDOWS\system32\SYSDRV.DAT
2007-05-27 00:56:19 -------- d-----w C:\Program Files\Synaptics
2007-05-27 00:56:18 -------- d-----w C:\Program Files\Realtek AC97
2007-05-27 00:56:16 -------- d-----w C:\Program Files\RALINK
2007-05-27 00:56:16 -------- d-----w C:\Program Files\Oca History Tool
2007-05-27 00:56:07 -------- d-----w C:\Program Files\NewTech Infosystems
2007-05-27 00:56:01 -------- d-----w C:\Program Files\Microsoft Works
2007-05-27 00:55:41 -------- d-----w C:\Program Files\CyberLink
2007-05-27 00:55:37 -------- d-----w C:\Program Files\AvRack
2007-05-27 00:55:35 -------- d-----w C:\Program Files\ATI Technologies
2007-05-27 00:55:35 -------- d-----w C:\Program Files\AMD
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 21:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 21:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 21:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 21:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 21:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 21:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 21:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 21:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-13 14:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-03-28 17:51:54 538,256 ----a-w C:\WINDOWS\system32\SymNeti.dll
2007-03-28 17:51:52 161,424 ----a-w C:\WINDOWS\system32\SymRedir.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
2005-12-07 16:06 399424 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2004-12-14 09:56 63136 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
2005-05-26 11:39 181352 --a------ C:\Program Files\Yahoo!\Common\yiesrvc.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{65D886A2-7CA7-479B-BB95-14D1EFB7946A}]
2005-01-24 09:55 115832 --a------ C:\Program Files\Yahoo!\Common\YIeTagBm.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
2005-10-22 18:29 94336 --a------ C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]
2007-05-23 12:13 140912 --a------ C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-05-28 18:39 2403392 -ra------ c:\program files\google\googletoolbar1.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
2006-09-27 17:45 544032 --a------ C:\Program Files\Windows Live Toolbar\msntb.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}]
2005-02-03 17:07 124032 --a------ C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 11:39 C:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-13 21:05]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-07-08 04:05]
"AGRSMMSG"="AGRSMMSG.exe" [2005-07-01 08:58 C:\WINDOWS\AGRSMMSG.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"Motive SmartBridge"="C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe" [2006-02-06 18:52]
"btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2005-12-29 11:22]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2003-12-09 12:03]
"Guard NT"="C:\Ikarus\GuardNT\GuardNT.exe" [2006-01-23 13:16]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-05-30 02:34]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-31 17:11]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c671c1e1-f10c-11da-9074-806d6172696f}]
AutoRun\command- D:\BSetup.EXE
*Newly Created Service* - COMHOST
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393
rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}
%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf
Contents of the 'Scheduled Tasks' folder
2007-05-30 12:16:14 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-30 22:23:01 C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
2007-06-08 20:45:52 C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - halinka.job
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-06-30 23:54:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-30 23:55:27
C:\ComboFix-quarantined-files.txt ... 2007-06-30 23:55
C:\ComboFix2.txt ... 2007-06-30 21:46
Hope this helps!
Cheers Mate
Ady