mannaoz

I started out doing this for the Desktop as I am in a state of disbelief here.
After reinstalling a new motherboard new ram new extra intems reinstall XpPro and doing all I thought to not have a problem Installed Comodo and all it components firewall aV malware protection etc. Seem to have some typs of infection. So I needed to use the laptop as my worktool and instruction pad whilst following the instructions thought I would do this at the same time. Well now I have info that looks like this one is got aids too.
Ay least I have been able to get to this point and make a comment. The Desk top will not let me install the Panda Active scan. Keep getting "Sorry,loading is incomplete due to an error. Please try again. Done this many tiimes only to get the same result. Even deleted alll cookies cklosed down the BioClean,Firewall,AV. and all other programs running.

Hope this is the correct proceedure here.

Deckard's System Scanner v20071014.68
Run by Administrator on 2008-04-09 20:59:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
16: 2008-04-09 10:59:17 UTC - RP431 - Deckard's System Scanner Restore Point
15: 2008-04-09 03:43:50 UTC - RP430 - Software Distribution Service 3.0
14: 2008-04-09 01:17:02 UTC - RP429 - System Checkpoint
13: 2008-04-06 12:48:25 UTC - RP428 - Software Distribution Service 3.0
12: 2008-04-06 11:00:42 UTC - RP427 - Software Distribution Service 3.0


-- First Restore Point --
1: 2008-03-23 05:51:55 UTC - RP416 - Software Distribution Service 3.0


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 448 MiB (512 MiB recommended).
System Drive C: has 0.83 GiB (less than 15%) free.


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-04-09 21:00:41
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\WINDOWS\soundman.exe
E:\Program Files\System Mechanic Professional 7\SMSystemAnalyzer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
C:\Program Files\REALTEK Semiconductor Corp\REALTEK RTL8180 Wireless LAN Driver and Utility\RtlWake.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\System Mechanic Professional 7\AntiVirus\iAVEmailScanner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
E:\Program Files\Spyware Doctor\pctsAuxs.exe
E:\Program Files\Spyware Doctor\pctsSvc.exe
E:\Program Files\Spyware Doctor\pctsTray.exe
C:\Documents and Settings\Administrator\Desktop\Downloads 2005 LT\DL 2008\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/en-au/srchasst/srchcust.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPSON Stylus C45 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.EXE /P23 "EPSON Stylus C45 Series" /O6 "USB001" /M "Stylus C45"
O4 - HKLM\..\Run: [SecuUFD] c:\docume~1\admini~1\locals~1\temp\secuhdd.exe sys_auto_run C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SMSystemAnalyzer] "E:\Program Files\System Mechanic Professional 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [iolo AntiVirus] "E:\Program Files\System Mechanic Professional 7\AntiVirus\ioloAV.exe"
O4 - HKLM\..\Run: [iolo Personal Firewall] "E:\Program Files\System Mechanic Professional 7\Personal Firewall\ioloFW.exe"
O4 - HKLM\..\Run: [ISTray] "E:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [RadarSync 2006] "E:\Program Files\RadarSync 2006\RSClient.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BlazeServoTool] "E:\Program Files\BlazeVideo\BlazeDTV2.1\MediaDetector.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: SkypeMate.lnk = C:\Program Files\SkypeMate\SkypeMate.exe
O4 - Global Startup: MA521 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe
O4 - Global Startup: RtlWake.lnk = C:\Program Files\REALTEK Semiconductor Corp.\REALTEK RTL8180 Wireless LAN Driver and Utility\RtlWake.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: Windows Desktop Search.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://E:\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://E:\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://E:\ieSpell\iespell.dll/SPELLCHECK.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://E:\ieSpell\iespell.dll/SPELLCHECK.HTM (file missing)
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://E:\ieSpell\iespell.dll/SPELLOPTION.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://E:\ieSpell\iespell.dll/SPELLOPTION.HTM (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - E:\Program Files\Hello\PicasaCapture.dll (file missing)
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - E:\Program Files\Hello\PicasaCapture.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: C:\Program Files\iolo\Common\Firewall\iFW_Xfilter.dll
O10 - Unknown file in Winsock LSP: C:\Program Files\iolo\Common\Firewall\iFW_Xfilter.dll
O10 - Unknown file in Winsock LSP: C:\Program Files\iolo\Common\Firewall\iFW_Xfilter.dll
O10 - Unknown file in Winsock LSP: C:\Program Files\iolo\Common\Firewall\iFW_Xfilter.dll
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\iavlsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/downlo...eckControl.cab
O16 - DPF: {2E4E43EA-F3C2-46B9-B387-A267E6969BD0} (voiceNow! Engage PC Client 1.0) - http://www.voicenow.com/engagegatewa...ushBrowser.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/inst...l/pinstall.cab
O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
O16 - DPF: {90F7E144-984F-4FA6-83A7-C9C8DCB9974C} (RSActiveXObj Control) - http://go.radarsync.com/RSActiveX.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\puresp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: dvpapi - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - E:\Program
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - E:\Program
O23 - Service: SmartLinkService (SLService) - Unknown owner - C:\WINDOWS\system32\slserv.exe


--
End of file - 14020 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - shell\open\command - NOTEPAD.EXE %1
.vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 XPacket (iolo Personal Firewall Driver) - c:\windows\system32\xpacket.sys <Not Verified; iolo technologies, LLC; iolo Firewall>
R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7>
R1 cdrbsvsd - c:\windows\system32\drivers\cdrbsvsd.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7>
R1 FileDisk - c:\windows\system32\drivers\filedisk.sys <Not Verified; iolo technologies, LLC (based on original work by Bo Brantén); filedisk (based on original work by Bo Brantén)>
R2 ousbehci (OrangeWare USB Enhanced Host Controller Service) - c:\windows\system32\drivers\ousbehci.sys <Not Verified; OrangeWare Corporation; USB 2.0 Enhanced Host Controller Driver>
R3 ousb2hub (OrangeWare USB 2.0 Root Hub Support) - c:\windows\system32\drivers\ousb2hub.sys <Not Verified; OrangeWare Corporation; USB 2.0 Hub Driver>
R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>
R3 SjyPkt - c:\windows\system32\drivers\sjypkt.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>

S3 BWNDIS5 (BWNDIS5 NDIS Protocol Driver) - c:\windows\system32\bwndis5.sys (file missing)
S3 cmuda (C-Media WDM Audio Interface) - c:\windows\system32\drivers\cmuda.sys (file missing)
S3 DW90USB (DW90USB Device) - c:\windows\system32\drivers\dw90usb.sys (file missing)
S3 PalmUSBD - c:\windows\system32\drivers\palmusbd.sys (file missing)
S3 SunkFilt6 (Alcor Micro Corp - 6360) - c:\windows\system32\drivers\sunkfilt6.sys (file missing)
S3 SunkFilt62 (Alcor Micro Corp - 6362) - c:\windows\system32\drivers\sunkfilt62.sys <Not Verified; Alcor Micro, Corp.; SunkFilt62>
S3 Sunkfiltp (HP && Alcor Micro Corp for Phison) - c:\windows\system32\drivers\sunkfiltp.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 sdAuxService (PC Tools Auxiliary Service) - e:\program files\spyware doctor\pctsauxs.exe
R2 sdCoreService (PC Tools Security Service) - e:\program files\spyware doctor\pctssvc.exe

S3 nmraapache (Pure Networks Net2Go Service) - "c:\program files\pure networks\network magic\webserver\bin\nmraapache.exe" -k runservice <Not Verified; Pure Networks, Inc.; Pure Networks Net2Go Service>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: SiS 900-Based PCI Fast Ethernet Adapter
Device ID: PCI\VEN_1039&DEV_0900&SUBSYS_2038161F&REV_91\3&267A616A&0&20
Manufacturer: SiS
Name: SiS 900-Based PCI Fast Ethernet Adapter
PNP Device ID: PCI\VEN_1039&DEV_0900&SUBSYS_2038161F&REV_91\3&267A616A&0&20
Service: SISNICXP


-- Scheduled Tasks -------------------------------------------------------------

2008-02-17 13:46:07 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-03-09 and 2008-04-09 -----------------------------

2008-04-09 20:34:48 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-09 20:34:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools
2008-04-09 2018 0 d-------- C:\WINDOWS\LastGood
2008-04-09 20:05:44 0 d-------- C:\Program Files\Panda Security


-- Find3M Report ---------------------------------------------------------------

2008-04-09 20:19:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\Skype
2008-04-09 20:05:46 3050 --a----c- C:\WINDOWS\mozver.dat
2008-04-06 22:46:09 0 d-------- C:\Documents and Settings\Administrator\Application Data\MailWasherPro
2008-03-13 09:08:46 38912 --a------ C:\WINDOWS\system32\smrgdf.exe
2008-03-13 08:25:46 32768 --a------ C:\WINDOWS\system32\iolobtdfg.exe
2008-03-03 07:47:46 0 d-------- C:\Program Files\Yahoo!
2008-03-02 16:10:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-02-17 14:08:40 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-02-17 13:02:13 0 d-------- C:\Documents and Settings\Administrator\Application Data\U3


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [27/03/2004 05:20 AM]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [27/03/2004 05:20 AM]
"EPSON Stylus C45 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe" [14/01/2004 04:00 AM]
"SecuUFD"="c:\docume~1\admini~1\locals~1\temp\secuhdd.exe" []
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [06/08/2004 05:01 PM]
"SiSPower"="SiSPower.dll" [09/01/2006 11:57 AM C:\WINDOWS\system32\SiSPower.dll]
"AudioDeck"="C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe" [10/01/2007 07:40 PM]
"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [02/05/2006 06:27 AM]
"SoundMan"="SOUNDMAN.EXE" [20/06/2005 08:42 PM C:\WINDOWS\soundman.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [12/01/2006 03:40 PM]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [09/03/2007 11:09 AM]
"SMSystemAnalyzer"="E:\Program Files\System Mechanic Professional 7\SMSystemAnalyzer.exe" [04/04/2008 11:32 AM]
"iolo AntiVirus"="E:\Program Files\System Mechanic Professional 7\AntiVirus\ioloAV.exe" [05/03/2008 09:48 AM]
"iolo Personal Firewall"="E:\Program Files\System Mechanic Professional 7\Personal Firewall\ioloFW.exe" [05/03/2008 10:06 AM]
"ISTray"="E:\Program Files\Spyware Doctor\pctsTray.exe" [10/04/2008 03:14 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RadarSync 2006"="E:\Program Files\RadarSync 2006\RSClient.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 10:00 PM]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [02/07/2007 12:40 AM]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [13/09/2007 01:31 PM]
"BlazeServoTool"="E:\Program Files\BlazeVideo\BlazeDTV2.1\MediaDetector.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"SMRequiresRestart"=

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Picasa Media Detector"=E:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\WINDOWS\Start Menu\Programs\Startup\
SkypeMate.lnk - C:\Program Files\SkypeMate\SkypeMate.exe [17/03/2006 5:22:10 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
MA521 Configuration Utility.lnk - C:\Program Files\NETGEAR\MA521 Configuration Utility\wlancfg5.exe [10/02/2005 11:28:40 AM]
RtlWake.lnk - C:\Program Files\REALTEK Semiconductor Corp.\REALTEK RTL8180 Wireless LAN Driver and Utility\RtlWake.exe [25/12/2005 12:36:56 PM]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [18/08/2006 4:46:26 PM]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [26/03/2006 10:44:08 PM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [13/03/2006 01:11 PM 233472]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
AutoRun\command- G:\LaunchU3.exe -a

*Newly Created Service* - IKFILESEC
*Newly Created Service* - IKSYSFLT
*Newly Created Service* - IKSYSSEC
*Newly Created Service* - RKPAVPROC
*Newly Created Service* - SDAUXSERVICE
*Newly Created Service* - SDCORESERVICE



-- End of Deckard's System Scanner: finished at 2008-04-09 21:03:23 ------------

Regards

Jeff Nield

mannaoz

Hi Folks
Well I still have this and laptop system with bloody Trojan.win32.monder.gen problems. Man if I could find these wankers I would be into them with a big stick and would continue to beat them until they looked like a jelly.
Now I am not a violent person but these maniacs need sending to the desert for a week oe more. Then lets see how smart they bloody are.

OK enough bitching, what do we do with my problems here.
Another post coming for the desk soon

Thanks in Advance
Jeff
If you know the location tell me I will be over there pronto

Ried

Hi Jeff,

I'm not seeing any active infection in your log. What tool alerted you to the presence of Trojan.win32.monder.gen, and what is it's location? What symptoms are you experiencing?


Use this online scanner:

Using Internet Explorer, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
  
  
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs!
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan

__________________

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

mannaoz

OK I got that underway but the desktop will not let me download this as it says its running with add-ons disabled and I cant find how to turn this on. I have read the instructions still NG never seen this before as I use firefox most of the time now?
A lead would be of help

Thanks in Advance Jeff in OZ

mannaoz

OK All finished boy that was a long one. But my other desktop is going to be longer.
Anyway here is the report
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, April 15, 2008 4:46:01 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 14/05/2008
Kaspersky Anti-Virus database records: 771702
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 64655
Number of viruses found: 5
Number of infected objects: 9
Number of suspicious objects: 6
Duration of the scan process: 02:32:07

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Application Data\iolo\SystemAnalyzer.log Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\cert8.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\foxmarks.log Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\history.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\key3.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\parent.lock Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\call256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\callmember256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chat256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chat512.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chatmember256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chatmsg1024.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chatmsg2048.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chatmsg256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chatmsg512.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\chatsync\44\446e796be6b828e2.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\contactgroup256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\dyncontent\bundle.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\index2.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\profile16384.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\transfer256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\transfer512.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\user1024.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\user16384.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\user256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\user4096.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Skype\mannaoz\voicemail256.dbb Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\Downloads 2005 LT\DL 2008\sdsetup.exe/file098 Infected: Backdoor.Win32.Rbot.pjh skipped
C:\Documents and Settings\Administrator\Desktop\Downloads 2005 LT\DL 2008\sdsetup.exe Inno: infected - 1 skipped
C:\Documents and Settings\Administrator\Desktop\Downloads 2005 LT\Nero-6.6.1.15a.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Documents and Settings\Administrator\Desktop\Downloads 2005 LT\Nero-6.6.1.15a.exe RAR: infected - 1 skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\n8dq7q0n.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\fb_3832.lck Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Perflib_Perfdata_ef8.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF799E.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFB252.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\iolo\AntiVirus\Quarantined\AUTORUN.INF.INFECTED Infected: Worm.Win32.Perlovga.a skipped
C:\Documents and Settings\All Users\Application Data\iolo\FileInfoList\IOLOFIL.FDB Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Pure Networks\Network Magic\Log\logfile.nmapp_exe.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Pure Networks\Network Magic\Log\logfile.nmsrvc_exe.txt Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{7F73E6A5-9243-4FBD-8181-99C2BE17185C}\RP437\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{67722036-5E24-497B-8C8E-1CA69249AF38}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\fb_716.lck Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Becky 2005 Files\3ea1cf6f.mb\!Trash\410824a9.bmf/[From the TR Blog =20][Date 26 May 2005 01:03:57 PDT]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
D:\Becky 2005 Files\3ea1cf6f.mb\!Trash\410824a9.bmf Mail: suspicious - 1 skipped
D:\Becky 2005 Files\3ea1cf6f.mb\!Trash\410824aa.bmf/[From the TR Blog =20][Date 02 Jun 2005 01:04:10 PDT]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
D:\Becky 2005 Files\3ea1cf6f.mb\!Trash\410824aa.bmf Mail: suspicious - 1 skipped
D:\Becky 2005 Files\3f2d9f59.mb\!Trash\#Attach\191.52e558d5.2a9AYC44@sol.com\sourberrys.zip.b64/pics.scr Infected: Trojan-Downloader.Win32.Small.axr skipped
D:\Becky 2005 Files\3f2d9f59.mb\!Trash\#Attach\191.52e558d5.2a9AYC44@sol.com\sourberrys.zip.b64 ZIP: infected - 1 skipped
D:\Becky 2005 Files\3f2d9f59.mb\!Trash\#Attach\191.52e558d5.2a9AYC44@sol.com\sourberrys.zip.b64 MIME.Broken: infected - 1 skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{7F73E6A5-9243-4FBD-8181-99C2BE17185C}\RP437\change.log Object is locked skipped
E:\Becky!\Administrator\3ea1cf6f.mb\!Trash\446395d8.bmf/[From eBay <aw-confirm@ebay.com>][Date Tue, 05 Dec 2006 05:04:07 +0200]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
E:\Becky!\Administrator\3ea1cf6f.mb\!Trash\446395d8.bmf Mail: suspicious - 1 skipped
E:\Program Files\Spyware Doctor\SDInfo.sdp Infected: Backdoor.Win32.Rbot.pjh skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{7F73E6A5-9243-4FBD-8181-99C2BE17185C}\RP437\change.log Object is locked skipped

Scan process completed.

Once again thanks for what you do

Jeff in OZ

Ried

You're welcome, Jeff.


Delete the following files:

C:\Documents and Settings\Administrator\Desktop\Downloads 2005 LT\DL 2008\ sdsetup.exe
C:\Documents and Settings\Administrator\Desktop\Downloads 2005 LT\ Nero-6.6.1.15a.exe
E:\Program Files\Spyware Doctor\ SDInfo.sdp

And the following e-mails:

D:\Becky 2005 Files\3ea1cf6f.mb\!Trash\410824a9.bmf
/[From the TR Blog =20][Date 26 May 2005 01:03:57 PDT]

D:\Becky 2005 Files\3ea1cf6f.mb\!Trash\410824aa.bmf
/[From the TR Blog =20][Date 02 Jun 2005 01:04:10 PDT]

D:\Becky 2005 Files\3f2d9f59.mb\!Trash\#Attach\191.52e558d5.2a9AYC44@sol.com\sourberrys.zip.b64

E:\Becky!\Administrator\3ea1cf6f.mb\!Trash\446395d8.bmf
/[From eBay <aw-confirm@ebay.com>][Date Tue, 05 Dec 2006 05:04:07 +0200]

-------------------------------------------------

In order to help you further, I need to know what symptoms are you experiencing.

__________________

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

mannaoz

Thanks for that work
I am at work at the moment and never knew I had a problem on the laptop. But was using this to see what I could do as my Desktop is the infected one and couldn't get things happening.
I still hav a problem with the DT being I see I need to use IE for most of what you ask but I can't see how to enable the addond in IE. Read all the instructions but nothing seems to work. Asi said I use firefox and have never seen this message on IE before>>??.
This one is infected with a win32 <> trojan and is getting slower and slower althought its running 4G ram its like a 64kb at the moment. I hope I don't have to reinstall again. But I am getting to that stage now. Have just built another machine just for playing and downloading free programs on so I will never get to this situation again. One hopes the last time this happened I installed all the Comodo suiet thinking this would help as I found the System Mechanic I was using screwed my system when they introduced V7,
Anyway thanks again will do the removes once at home in 7 hours time.
Hope this helps

Jeff in OZ

mannaoz

OK thanks done that except 2 files I couldn't delete
E:\Program Files\Spyware Doctor\ SDInfo.sdp acess denied ?
E:\Becky!\Administrator\3ea1cf6f.mb\!Trash\446395d8.bmf
/[From eBay <aw-confirm@ebay.com>][Date Tue, 05 Dec 2006 05:04:07 +0200] Just didnt delete ?.
Also I have a screen dump of things in the windows program that has been a bug bear for ages. They are files called " #NtUninstallKB867282$" and the like all going back to 2005 seems to be a wasted file or do they have to stay.

I still can't access the desktop to start the cleaning process. Can I use a flash drive to copy the programs needed and circumvent this virus. If so how should I do this,

Regards and Thanks

Jeff in OZ

Ried

Jeff, forgive me, but you have me a bit confused here. Please let me know if I am understanding you properly...

1. The issue is with the another computer, not the one you've posted logs for in this thread.

2. The computer that has the problems--you cannot access desktop.


If #2 is correct, please explain that a bit more for me. Does Windows load at all? Can the desktop be accessed when you boot into Safe Mode?

__________________

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

mannaoz

Sorry for the confusion.
We have 32 different machines here
The Lap top your are doing with me and the desk top that I have an issue with as well,
I realized that you may be not understanding what I was saying so I have posted a new item to the forum about the desk top for review.
I still can't access the desktop to start the cleaning process. Can I use a flash drive to copy the programs needed and circumvent this virus.IE kapersky or hyjack this. If so how should I do this,
Hope this helps. Sorry again
We should proceed with the lap top to a conclusion first.

Ried

Hi Jeff,

Our assistance is typically for personal computers--home use. With this many machines, isn't there an IT dept?

Yes.

Exactly what issue remains for this one.

__________________

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006