|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-29-2006, 03:25 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Downloader.agent.uj
Hi, I think there's something in my computer and everytime i try to run ewido, it detects downloader.agent.uj, and then it would scan for about 10 minutes or less, then this dialog box will come up... "Something bad happened in the application. Error diagnostic file saved to 'C:\Program Files\ewido anti-spyware 4.0\ewido.err' ". Can't never finish the scan as this message will always show up and shut down ewido. Same thing happened when i tried to run Cleanup and it would not let it finish flushing or the cleaning up process. My computer has been very slow and this is worrying me. Please help with my hijack log.
thank you. Logfile of HijackThis v1.99.1 Scan saved at 4:16:48 PM, on 7/29/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\MSSQL7\binn\sqlservr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\MSSQL7\Binn\sqlmangr.exe C:\WINDOWS\system32\wuauclt.exe C:\DOCUME~1\Brittney\LOCALS~1\Temp\~AceTemp\hijackthis[1]\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?p=1152147605 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - URLSearchHook: (no name) - {EA244BC1-F827-1A91-CCB1-2352A8D94E14} - MsNetHelper.dll (file missing) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Brittney\Application Data\Mozilla\Profiles\default\sxdqavkw.slt\prefs.js) O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [SysProc] C:\WINDOWS\apgf[1].exe O4 - HKLM\..\Run: [InpriseMon] RtlFindVal.exe O4 - HKLM\..\Run: [prcmon] Shaitan1678.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - HKCU\..\Run: [TForm1] NsCplTray.exe O4 - HKCU\..\Run: [MONITER] StatusCheck.exe O4 - HKCU\..\Run: [init32] NukeSpan.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Service Manager.lnk = C:\MSSQL7\Binn\sqlmangr.exe O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: AbsolutePoker.net - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\AbsolutePoker NET\AbsolutePoker NET.lnk O9 - Extra 'Tools' menuitem: AbsolutePoker.net - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\AbsolutePoker NET\AbsolutePoker NET.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://nwa.mlxchange.com/Control/Mul...ctComboBox.cab O16 - DPF: {5EFF8B09-B211-42B7-805E-C4670BF8C830} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://nwa.mlxchange.com/Control/MLXClientUtils.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://nwa.mlxchange.com/Control/IRCSharc.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?322 O17 - HKLM\System\CCS\Services\Tcpip\..\{C0EC8E46-65F2-44E1-AEDB-95768E1E7C06}: NameServer = 85.255.116.147,85.255.112.231 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-30-2006, 11:04 PM
|
#3 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
Hello blitz960,
You may want to print out these instructions for reference, since you will have to restart your computer during the fix. **************************************************************** Before we begin, please move HiJackThis to it's own folder, like c:\HJT. When we're done 'cleaning' off your system, we're going to 'flush' the temporary folders which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later. **************************************************************** Please make sure you have an ACTIVE internet connection as the tool will need to download additional files and a program. Please download FixWareout from one of these sites: http://forums.subratam.org/index.php...=post&id=43811 http://swandog46.geekstogo.com/Fixwareout.exe Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is NORMAL. When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items: O17 - HKLM\System\CCS\Services\Tcpip\..\{C0EC8E46-65F2-44E1-AEDB-95768E1E7C06}: NameServer = 85.255.116.147,85.255.112.231 Click Fix Checked. Close HijackThis, and click OK to proceed. At the end of the fix, you may need to restart your computer again. ------------------------------------------------ Perform an online scan using Internet Explorer with Panda ActiveScan ** click on "Free use ActiveScan" located on the top right hand corner
Please include the following in your next reply: C:\fixwareout\report.txt Panda results New HijackThis log |
|
|
|
|
07-31-2006, 04:05 PM
|
#4 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hi, I have done as instructed. Below are my reports.
Logfile of HijackThis v1.99.1 Scan saved at 4:54:12 PM, on 7/31/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\MSSQL7\binn\sqlservr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\Save\Save.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\MSSQL7\Binn\sqlmangr.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe C:\Program Files\hijackthis2\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - URLSearchHook: (no name) - {EA244BC1-F827-1A91-CCB1-2352A8D94E14} - MsNetHelper.dll (file missing) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Brittney\Application Data\Mozilla\Profiles\default\sxdqavkw.slt\prefs.js) O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [InpriseMon] RtlFindVal.exe O4 - HKLM\..\Run: [prcmon] Shaitan1678.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [LanzarP2006] "C:\DOCUME~1\Brittney\LOCALS~1\Temp\{A572E7E1-29F1-431F-B494-15EA18F9B826}\{EEBA9416-3207-47E0-9022-116440599DBC}\..\..\P2006tmp\Install.exe" /SETUP:"/l0x0009" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - HKCU\..\Run: [TForm1] NsCplTray.exe O4 - HKCU\..\Run: [MONITER] StatusCheck.exe O4 - HKCU\..\Run: [init32] NukeSpan.exe O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Service Manager.lnk = C:\MSSQL7\Binn\sqlmangr.exe O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: AbsolutePoker.net - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\AbsolutePoker NET\AbsolutePoker NET.lnk O9 - Extra 'Tools' menuitem: AbsolutePoker.net - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\AbsolutePoker NET\AbsolutePoker NET.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://nwa.mlxchange.com/Control/Mul...ctComboBox.cab O16 - DPF: {5EFF8B09-B211-42B7-805E-C4670BF8C830} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://nwa.mlxchange.com/Control/MLXClientUtils.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://nwa.mlxchange.com/Control/IRCSharc.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?322 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe Pandascan results Incident Status Location Adware:Adware/SaveNow Not disinfected c:\program files\save\save.exe Virus:Trj/LowZones.OU Disinfected Operating system Adware:Adware/SaveNow Not disinfected C:\Program Files\Save\ACM.dll Adware:adware/superspider Not disinfected c:\windows\system32\d2kpax.dll Adware:adware/msxmidi Not disinfected c:\windows\msxmidi.exe Adware:adware/whenusearch Not disinfected C:\Documents and Settings\Brittney\Start Menu\Programs\WhenU Potentially unwanted tool:application/winfixer2005 Not disinfected c:\program files\common files\WinSoftware Adware:adware/savenow Not disinfected c:\program files\Save Adware:adware/startpage.na Not disinfected Windows Registry Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Brittney\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-1fd2d78d-17370730.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Brittney\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-2d878585-4bef7540.zip[Dummy.class] Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Brittney\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-61590412-560358ea.zip[Dummy.class] Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@adrevolver[2].txt Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@ads.addynamix[1].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@ads.pointroll[1].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@apmebf[2].txt Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@bravenet[1].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@com[1].txt Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@maxserving[2].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@realmedia[1].txt Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@toplist[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brittney\Cookies\brittney@tribalfusion[1].txt Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Brittney\Desktop\smitRem.exe[smitRem/Process.exe] Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Brittney\Local Settings\Temp\Cookies\brittney@adrevolver[3].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Brittney\Local Settings\Temp\Cookies\brittney@apmebf[1].txt Fixwareout report Fixwareout ver 1.003 Last edited 07/1/2006 Post this report in the forums please Reg Entries that were deleted HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\xedocne HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\repiwoh HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\23plhps HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\mgcppp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\tesvaf HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\32refaselif HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\iwmmd HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\golmedi HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd ... Microsoft (R) Windows Script Host Version 5.6 Random Runs removed from HKLM ... PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Example ipsec6.exe is legitimate »»»»» Search by size and names... »»»»» Misc files »»»»» Checking for older varients covered by the Rem3 tool »»»»» Search five digit cs, dm and jb files This WILL/CAN also list Legit Files, Submit them at Virustotal C:\WINDOWS\SYSTEM32\CSZJQ.EXE 51,200 2006-01-02 Other suspects Directory of C:\WINDOWS\system32 Thank you. |
|
|
|
|
07-31-2006, 06:18 PM
|
#5 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
Hi blitz960,
Good, now we can get the rest of them.  Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out these instructions. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ********************************************************************************************************** Download and install CleanUp! NOTE: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Do NOT run this program if you have XP Professional 64 bit edition. If you are unsure, you can download & run this tool to find out .....http://www.kellys-korner-xp.com/regs...p_whichcpu.exe ----------------------------------------- Please disable the following program(s) as they may interfere with the fixes below. You may re-enable them when we are through: Windows Defender:
Ewido Guard
********************************************************************************************************** Please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login on your usual account. Make sure to close any open browsers. ----------------------------------- Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: Save WhenU Viewpoint Manager ----------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [InpriseMon] RtlFindVal.exe O4 - HKLM\..\Run: [prcmon] Shaitan1678.exe O4 - HKLM\..\Run: [LanzarP2006] "C:\DOCUME~1\Brittney\LOCALS~1\Temp\{A572E7E1-29F1-431F-B494-15EA18F9B826}\{EEBA9416-3207-47E0-9022-116440599DBC}\..\..\P2006tmp\Install.exe" /SETUP:"/l0x0009" O4 - HKCU\..\Run: [TForm1] NsCplTray.exe O4 - HKCU\..\Run: [MONITER] StatusCheck.exe O4 - HKCU\..\Run: [init32] NukeSpan.exe O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" Click 'Fix Checked' and close HijackThis. ----------------------------------- Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading: * select Show hidden files and folders. * Uncheck Hide protected operating system files (recommended) option. *Also, make sure there is no checkmark beside Hide file extensions for known file types. * Click OK. ----------------------------------- Delete the following Files and Folders if they still exist. C:\Program Files\ Save C:\Program Files\ Viewpoint C:\WINDOWS\SYSTEM32\ CSZJQ.EXE c:\windows\system32\ d2kpax.dll c:\windows\ msxmidi.exe C:\Documents and Settings\Brittney\Start Menu\Programs\ WhenU c:\program files\common files\ WinSoftware Do a search for the following via Start>Search>All files and folders: RtlFindVal.exe Shaitan1678.exe NsCplTray.exe StatusCheck.exe NukeSpan.exe ----------------------------------- *WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! or move them to a permanent location. Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: *Click "Options..." *Move the arrow down to "Custom CleanUp!" *Put a check next to the following:
Press the CleanUp! button to start the program. Reboot/logoff when prompted. ----------------------------------- Reboot into Normal Mode. ----------------------------------- Run another online scan at Panda and save the results. In your next reply, please include the following: Panda results New HijackThis log Update on your system behavior |
|
|
|
|
08-01-2006, 10:18 AM
|
#6 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hello, ...
I did all the steps that was instructed and here's my hijack log. There seems to be something wrong with the panda scan. i left the scan overnight and this morning when i checked it, it was still telling me that activeX is still loading... the same thing happened to me yesterday when i did my first pandascan, . it took 4 hours for the activeX to load and the scan to end. anyways,... i'm sorry i could not get the panda scan results. Please let me know what else i can do in lieu of the panda scan. thank you.  Logfile of HijackThis v1.99.1 Scan saved at 11:12:25 AM, on 8/1/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\MSSQL7\binn\sqlservr.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Program Files\Windows Defender\MSASCui.exe C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\MSSQL7\Binn\sqlmangr.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\hijackthis2\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R3 - URLSearchHook: (no name) - {EA244BC1-F827-1A91-CCB1-2352A8D94E14} - MsNetHelper.dll (file missing) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Brittney\Application Data\Mozilla\Profiles\default\sxdqavkw.slt\prefs.js) O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Service Manager.lnk = C:\MSSQL7\Binn\sqlmangr.exe O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: AbsolutePoker.net - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\AbsolutePoker NET\AbsolutePoker NET.lnk O9 - Extra 'Tools' menuitem: AbsolutePoker.net - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\All Users\Start Menu\Programs\AbsolutePoker NET\AbsolutePoker NET.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://nwa.mlxchange.com/Control/Mul...ctComboBox.cab O16 - DPF: {5EFF8B09-B211-42B7-805E-C4670BF8C830} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://nwa.mlxchange.com/Control/MLXClientUtils.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://nwa.mlxchange.com/Control/IRCSharc.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?322 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe |
|
|
|
|
08-01-2006, 07:01 PM
|
#7 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
4 hours is crazy..
 Try this scanner: Please perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
|
|
|
|
|
08-01-2006, 09:08 PM
|
#8 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hello again, ..
Kaspersky Scan only took about an hour or so and its done. here's the report from the scan. thank you. --------- KASPERSKY ONLINE SCANNER REPORT Tuesday, August 01, 2006 10:03:01 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 2/08/2006 Kaspersky Anti-Virus database records: 211493 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 69868 Number of viruses found: 39 Number of infected objects: 232 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:04:46 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-04252006-205707.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2006-08-01_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\Brittney\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\Brittney\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Brittney\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Brittney\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Brittney\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Brittney\Local Settings\History\History.IE5\MSHist012006080120060802\index.dat Object is locked skipped C:\Documents and Settings\Brittney\Local Settings\Temp\~DF7240.tmp Object is locked skipped C:\Documents and Settings\Brittney\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Brittney\My Documents\limewire\!! rolex golf commercial 01.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped C:\Documents and Settings\Brittney\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Brittney\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\MSSQL7\Data\master.mdf Object is locked skipped C:\MSSQL7\Data\mastlog.ldf Object is locked skipped C:\MSSQL7\Data\model.mdf Object is locked skipped C:\MSSQL7\Data\modellog.ldf Object is locked skipped C:\MSSQL7\Data\TEMPDB.MDF Object is locked skipped C:\MSSQL7\Data\TEMPLOG.LDF Object is locked skipped C:\MSSQL7\LOG\ERRORLOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPStop.log Object is locked skipped C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton AntiVirus\Quarantine\02772F22.RB0/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.l skipped C:\Program Files\Norton AntiVirus\Quarantine\02772F22.RB0/counter.class Infected: Trojan.Java.ClassLoader.b skipped C:\Program Files\Norton AntiVirus\Quarantine\02772F22.RB0/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.d skipped C:\Program Files\Norton AntiVirus\Quarantine\02772F22.RB0/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\02772F22.RB0 ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\02772F22.RB0 CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\027A591E.zip/a.class Infected: Trojan.Java.ClassLoader.b skipped C:\Program Files\Norton AntiVirus\Quarantine\027A591E.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\027A591E.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.u skipped C:\Program Files\Norton AntiVirus\Quarantine\027A591E.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\027A591E.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\027E031B.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\027E031B.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\027E031B.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\027E031B.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\027E031B.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\027E031B.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\05F93CA4.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\06387E30.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\06387E30.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\06387E30.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\06387E30.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\06387E30.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\06387E30.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\0821198A.tmp Infected: Trojan.Java.ClassLoader.z skipped C:\Program Files\Norton AntiVirus\Quarantine\09165B8C.exe Infected: Trojan.Win32.Qhost.df skipped C:\Program Files\Norton AntiVirus\Quarantine\09377F68.dat Infected: Trojan-Downloader.Win32.Small.awa skipped C:\Program Files\Norton AntiVirus\Quarantine\09377F68.exe Infected: Trojan-Downloader.Win32.Small.awa skipped C:\Program Files\Norton AntiVirus\Quarantine\093A2964.exe Infected: not-a-virus:AdWare.Win32.Msnagent.b skipped C:\Program Files\Norton AntiVirus\Quarantine\093D5361.exe Infected: not-a-virus:AdWare.Win32.FindSpy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\09417D5D.exe Infected: Trojan-Downloader.Win32.Small.awa skipped C:\Program Files\Norton AntiVirus\Quarantine\0D2E2E1F.tmp Infected: Trojan.Java.ClassLoader.ak skipped C:\Program Files\Norton AntiVirus\Quarantine\12435348.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\12435348.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\12435348.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\12435348.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\12435348.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\12435348.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\12D245FD.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\12D245FD.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\12D245FD.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\12D245FD.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\12D245FD.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\12D245FD.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\178E12C0.zip/Beyond.class Infected: Trojan.Java.Needy.c skipped C:\Program Files\Norton AntiVirus\Quarantine\178E12C0.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\178E12C0.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\178E12C0.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\178E12C0.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\17BA4998.tmp Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\1C64707E.zip/Beyond.class Infected: Trojan.Java.Needy.c skipped C:\Program Files\Norton AntiVirus\Quarantine\1C64707E.zip/BlackBox.class Infected: Trojan.Java.ClassLoader.s skipped C:\Program Files\Norton AntiVirus\Quarantine\1C64707E.zip/VerifierBug.class Infected: Trojan.Java.Needy.c skipped C:\Program Files\Norton AntiVirus\Quarantine\1C64707E.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\1C64707E.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\1C843C8C.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\1C843C8C.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\1C843C8C.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\1C843C8C.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\1C843C8C.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\1C843C8C.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\1D387A96.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\1D387A96.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\1D387A96.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\1D387A96.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\1D387A96.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\1D387A96.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\2D8131AE.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\2D8131AE.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\2D8131AE.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\2D8131AE.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\2D8131AE.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\2D8131AE.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\30A2068D.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\31747F86.exe Infected: Trojan-Downloader.Win32.Agent.sy skipped C:\Program Files\Norton AntiVirus\Quarantine\3260304B.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\3260304B.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\3260304B.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\3260304B.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\3260304B.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\3260304B.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\37875E19.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\391008EA.zip/Beyond.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\391008EA.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\391008EA.zip/VerifierBug.class Infected: Trojan.Java.Needy.c skipped C:\Program Files\Norton AntiVirus\Quarantine\391008EA.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\391008EA.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\3B366060.zip/Counter.class Infected: Trojan.Java.ClassLoader.h skipped C:\Program Files\Norton AntiVirus\Quarantine\3B366060.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped C:\Program Files\Norton AntiVirus\Quarantine\3B366060.zip/Parser.class Infected: Trojan.Java.ClassLoader.d skipped C:\Program Files\Norton AntiVirus\Quarantine\3B366060.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\3B366060.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\3E3F192F.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\3E3F192F.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\3E3F192F.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped C:\Program Files\Norton AntiVirus\Quarantine\3E3F192F.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\3E3F192F.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\42657C47.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\42B4305A.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.e skipped C:\Program Files\Norton AntiVirus\Quarantine\42B4305A.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\42B4305A.zip/WebCounter.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\42B4305A.zip/a.class Infected: Trojan.Java.Shiwow skipped C:\Program Files\Norton AntiVirus\Quarantine\42B4305A.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\42B4305A.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\43594F99.zip/Beyond.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\43594F99.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\43594F99.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\43594F99.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\43594F99.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\458309ED.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\458309ED.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\458309ED.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\458309ED.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\458309ED.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\458309ED.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\483A1920.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\4C5B6EF6.tmp Infected: Trojan.Java.ClassLoader.z skipped C:\Program Files\Norton AntiVirus\Quarantine\4C5F18F2.tmp Infected: Trojan.Java.ClassLoader.z skipped C:\Program Files\Norton AntiVirus\Quarantine\4C6242EF.tmp Infected: Trojan.Java.ClassLoader.ai skipped C:\Program Files\Norton AntiVirus\Quarantine\51C36B4C.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\51C36B4C.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\51C36B4C.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\51C36B4C.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\51C36B4C.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\51C36B4C.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\51DB068A.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\51DB068A.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\51DB068A.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped C:\Program Files\Norton AntiVirus\Quarantine\51DB068A.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\51DB068A.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\523B1951.zip/Bubble.class Infected: Trojan.Java.ClassLoader.Dummy.e skipped C:\Program Files\Norton AntiVirus\Quarantine\523B1951.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\523B1951.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.c skipped C:\Program Files\Norton AntiVirus\Quarantine\523B1951.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenStream.h skipped C:\Program Files\Norton AntiVirus\Quarantine\523B1951.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\523B1951.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\5287178D.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\5287178D.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\5287178D.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\5287178D.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\5287178D.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\5287178D.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\52F60C1F.tmp Infected: Trojan.Java.ClassLoader.ak skipped C:\Program Files\Norton AntiVirus\Quarantine\53492912.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\5542643F.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped C:\Program Files\Norton AntiVirus\Quarantine\57020D9E.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\57020D9E.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\57020D9E.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\57020D9E.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\57020D9E.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\57020D9E.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\5F470A06.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\5F470A06.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\5F470A06.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\5F470A06.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\5F470A06.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\5F470A06.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\61EF27D0.tmp Infected: Trojan.Java.ClassLoader.ak skipped C:\Program Files\Norton AntiVirus\Quarantine\624C1A8C.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\624C1A8C.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\624C1A8C.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\624C1A8C.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\624C1A8C.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\624C1A8C.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\65357993.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\65357993.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\65357993.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\65357993.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\65357993.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\65357993.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\6B707E97.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\6B707E97.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\6B707E97.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\6B707E97.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\6B707E97.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\6B707E97.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\6C0D4216.zip/Jvb.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\6C0D4216.zip/MyFunction.class Infected: Trojan-Dropper.Java.Small.c skipped C:\Program Files\Norton AntiVirus\Quarantine\6C0D4216.zip/MainApp.class Infected: Trojan.Java.ClassLoader.f skipped C:\Program Files\Norton AntiVirus\Quarantine\6C0D4216.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\6C0D4216.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\6F6F3A41.tmp Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\71D54352.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c skipped C:\Program Files\Norton AntiVirus\Quarantine\71D54352.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\71D54352.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped C:\Program Files\Norton AntiVirus\Quarantine\71D54352.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Norton AntiVirus\Quarantine\71D54352.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\71D54352.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\741D5BEC.zip/BlackBox.class Infected: Trojan.Java.ClassLoader.j skipped C:\Program Files\Norton AntiVirus\Quarantine\741D5BEC.zip/Beyond.class Infected: Trojan-Dropper.Java.Beyond.c skipped C:\Program Files\Norton AntiVirus\Quarantine\741D5BEC.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\741D5BEC.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.d skipped C:\Program Files\Norton AntiVirus\Quarantine\741D5BEC.zip ZIP: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\741D5BEC.zip CryptFF: infected - 4 skipped C:\Program Files\Norton AntiVirus\Quarantine\76DD65F0.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\76DD65F0.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped C:\Program Files\Norton AntiVirus\Quarantine\76DD65F0.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped C:\Program Files\Norton AntiVirus\Quarantine\76DD65F0.zip ZIP: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\76DD65F0.zip CryptFF: infected - 3 skipped C:\Program Files\Norton AntiVirus\Quarantine\7A315371.tmp Infected: Trojan-Downloader.Java.OpenConnection.v skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\debug.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\debug.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\error.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\error.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\hips.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\hips.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\ids.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\ids.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\network.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\network.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\system.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\system.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\warning.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\warning.log.idx Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\web.log Object is locked skipped C:\Program Files\Sunbelt Software\Personal Firewall\logs\web.log.idx Object is locked skipped C:\Program Files\WinAce\VVSNInst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP597\A0036802.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP603\A0036861.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP604\A0036873.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP606\A0036956.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP610\A0037953.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP614\A0037999.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP616\A0038018.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP618\A0038052.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP619\A0039050.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP623\A0039112.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP624\A0039153.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP625\A0039167.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP627\A0039209.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP628\A0039240.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP629\A0039266.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0039289.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0039296.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0040295.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0041295.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP632\A0041346.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP632\A0041357.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP634\A0041434.exe Infected: Trojan-Dropper.Win32.Agent.asf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP634\A0041448.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP636\A0041589.exe Infected: Trojan.Win32.Pakes skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP636\A0041612.exe Infected: Trojan.Win32.Favadd.an skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP636\A0041622.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bo skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041685.dll Infected: not-a-virus:AdWare.Win32.SaveNow.ce skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041686.exe Infected: not-a-virus:AdWare.Win32.SaveNow.cb skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041690.exe Infected: not-a-virus:AdWare.Win32.SaveNow.cb skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041712.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP638\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{3FADECB4-FC1D-449B-86F0-7418ADBF376F}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
|
|
|
08-01-2006, 09:50 PM
|
#9 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
Hi blitz960,
Sorry, your commercial is infected and has to go. Delete this file: C:\Documents and Settings\Brittney\My Documents\limewire\ !! rolex golf commercial 01.wma How is your system behaving? |
|
|
|
|
08-01-2006, 11:10 PM
|
#10 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hi ried, ..
I deleted the commercial. one of my main problems was that ewido could not run or scan initially. I ran a scan a while ago and it RAN!  so, ...i was glad that happened. but it was still detecting downloader.agent.uj. below is the report from ewido if you need it. My computer is still very slow, in fact ... it might be a little slower than before. Why do you think thats the case?... Thank you. ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 12:05:03 AM 8/2/2006 + Scan result: C:\Program Files\WinAce\VVSNInst.exe -> Adware.SaveNow : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP636\A0041622.exe -> Adware.SaveNow : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041685.dll -> Adware.SaveNow : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041686.exe -> Adware.SaveNow : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041690.exe -> Adware.SaveNow : No action taken. HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP597\A0036802.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP603\A0036861.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP604\A0036873.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP606\A0036956.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP610\A0037953.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP614\A0037999.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP616\A0038018.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP618\A0038052.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP619\A0039050.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP623\A0039112.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP624\A0039153.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP625\A0039167.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP627\A0039209.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP628\A0039240.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP629\A0039266.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0039289.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0039296.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0040295.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP630\A0041295.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP632\A0041346.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP632\A0041357.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP634\A0041448.exe -> Downloader.Agent.uj : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP637\A0041712.exe -> Downloader.Agent.uj : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@ads.addynamix[1].txt -> TrackingCookie.Addynamix : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@e-2dj6wfkikncpwbo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@e-2dj6wfkiqjc5oep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@e-2dj6wjl4amajcbo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@e-2dj6wjmyeod5sgo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@ads.pointroll[1].txt -> TrackingCookie.Pointroll : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@questionmarket[1].txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\Brittney\Cookies\brittney@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.38:C:\Documents and Settings\Brittney\Application Data\Mozilla\Firefox\Profiles\fae56ruz.default\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.39:C:\Documents and Settings\Brittney\Application Data\Mozilla\Firefox\Profiles\fae56ruz.default\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.40:C:\Documents and Settings\Brittney\Application Data\Mozilla\Firefox\Profiles\fae56ruz.default\cookies.txt -> TrackingCookie.Zedo : No action taken. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP636\A0041612.exe -> Trojan.Favadd.an : No action taken. ::Report end |
|
|
|
|
08-02-2006, 07:41 AM
|
#11 (permalink) | |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
Hi,
Quote:
Do you remember where you downloaded WinAce from?--it is showing as infected. Let's take a deeper look at your system:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall |
|
|
|
|
|
08-02-2006, 11:02 AM
|
#12 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hello ried, .
I'm glad that downloader.agent.uj is not of any worries now. ... umm... i think i downloaded winace from the winace website. it would not let me run hijackthis without winace. below is my report from combofix. btw, .. there are a few sites that i have to access for my work but it seems like i can't get on to it. everytime i type in the address, a blank page comes up and says, .."Ad blocked here by KPF"... do you know why?... those are a few sites i really have to have access to. .. thank you. Start Time= Wed 08/02/2006 11:51:58.12 Running from: C:\Documents and Settings\Brittney\Desktop QuickScan did not find any signs of infected files (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-07-31 11:00:36 ( .D... ) "C:\Program Files\hijackthis2" 2006-07-29 16:41:56 ( .D... ) "C:\Program Files\Sunbelt Software" 2006-07-29 16:30:28 ( .D... ) "C:\Program Files\Alwil Software" 2006-07-26 18:10:14 ( .D... ) "C:\Program Files\ewido anti-spyware 4.0" 2006-06-19 16:20:42 702768 ( A.... ) "C:\WINDOWS\SYSTEM32\WgaLogon.dll" 2006-05-19 07:59:42 148480 ( A.... ) "C:\WINDOWS\SYSTEM32\dnsapi.dll" 2006-05-19 07:59:42 111616 ( A.... ) "C:\WINDOWS\SYSTEM32\dhcpcsvc.dll" 2006-05-19 07:59:42 94720 ( A.... ) "C:\WINDOWS\SYSTEM32\iphlpapi.dll" 2005-03-13 05:18:12 7741336 ( A.... ) "C:\Program Files\DivX521XP2K.exe" 2005-03-13 05:05:02 8414282 ( A.... ) "C:\Program Files\vlc-0.6.2.dmg" 2005-03-13 04:43:58 7071334 ( A.... ) "C:\Program Files\vlc-0.8.1-win32.exe" 2005-02-19 16:07:56 295120 ( A.... ) "C:\Program Files\NSSetup.exe" 2004-10-03 00:50:56 315624 ( A.... ) "C:\Program Files\dxwebsetup.exe" 2004-10-03 00:48:24 10135688 ( A.... ) "C:\Program Files\MPSetupXP.exe" 2004-08-20 12:49:40 266240 ( A.... ) "C:\Program Files\ie-spyad.exe" 2004-08-19 19:52:22 0 ( ..SHR ) "C:\Program Files\q330994.exe" (((((((((((((((((((((((((((((((((((((( Files Created - Last 30days ))))))))))))))))))))))))))))))))))))))))))) 2006-08-01 00:46 266,407,936 C:\hiberfil.sys 2006-07-31 10:58 218,112 C:\HijackThis.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe" "PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd.exe\"" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "eBayToolbar"="C:\\Program Files\\eBay\\eBay Toolbar2\\eBayTBDaemon.exe" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "PopUpStopperFreeEdition"="\"C:\\PROGRA~1\\PANICW~1\\POP-UP~1\\PSFree.exe\"" "MSMsgSvc"="" "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,42,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system DisableTaskMgr REG_DWORD 0 (0x0) NoColorChoice REG_DWORD 0 (0x0) NoSizeChoice REG_DWORD 0 (0x0) NoDispScrSavPage REG_DWORD 0 (0x0) NoDispCPL REG_DWORD 0 (0x0) NoVisualStyleChoice REG_DWORD 0 (0x0) NoDispSettingsPage REG_DWORD 0 (0x0) NoDispAppearancePage REG_DWORD 0 (0x0) NoDispBackgroundPage REG_DWORD 0 (0x0) DisableRegistryTools REG_DWORD 0 (0x0) HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WinDefend Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\MP Scheduled Scan.job C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Brittney.job Completion time: Wed 08/02/2006 11:52:55.37 ComboFix ver 06.07.15/28 - This logfile is located at C:\ComboFix.txt |
|
|
|
|
08-02-2006, 09:21 PM
|
#13 (permalink) | ||
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
Hello blitz960,
Quote:
You already have Norton Internet Security Suite, correct? If so, you already have a firewall and you need to uninstall Kerio. More than one installed Anti Virus or Firewall can cause confusion between the programs as well as system instability. Go to your Add/Remove programs and you should see Kerio Personal Firewall in the list. Click 'Remove'. and reboot. -------------------------------- Quote:
|
||
|
|
|
|
08-02-2006, 10:42 PM
|
#14 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hi Ried,
What I meant when i made that comment about winace is that when i tried to run hijackthis, a dialog box popped up saying that my beta version is outdated and something about needing to be updated. when i click "ok", it directed me to the winace site. in short, my puter would not let me run hijackthis unless i download the latest version of winace. anyways, after i did that, hijackthis ran smoothly. And yes, thanks for the tip about Kerio Firewall. I didnt know that having more than one firewall can cause the system to be unstable. what else should i do now?..my puter is still kinda slow but at least ewido and cleanup is running smoothly now. |
|
|
|
|
08-03-2006, 05:14 PM
|
#15 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
Hi blitz960,
I'd like you to run one more scanner to ensure nothing else is lurking about. Download Dr.Web CureIt to the desktop: ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
|
|
|
|
|
08-03-2006, 11:09 PM
|
#16 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hello Ried,
I did a scan using the Drweb cureit as instructed and below is my report. Please have a look. Thank you. iKernel.dll;C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32;Probably DLOADER.Trojan;Incurable.Moved.; A0041823.exe;C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP638;Adware.SaveNow;Incurable.Moved.; A0042204.ocx;C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP645;Adware.Gdown;Incurable.Moved.; |
|
|
|
|
08-03-2006, 11:54 PM
|
#17 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
Hi,
This entry is legit: C:\Program Files\Common Files\InstallShield We can place it back in it's original location. Currently, it's been moved to DrWeb's quarantine folder, which should be located at C:\Documents and Settings\Brittney\DoctorWeb\Quarantine. Cut the iKernel.dll from that folder and paste it back into the Intel 32 folder located here: C: Program Files\Common Files\Installation Shield\Engine\6\ Intel 32 Please let me know if you had any difficulty. |
|
|
|
|
08-04-2006, 10:58 AM
|
#18 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hello Ried, ..
I have cut and paste the particular file. what can i do next?.. Can i re-enable my windows defender and ewido guard?... Also, i had uncheck the "Hide protected operating system files" a few days ago,..should i check it back?..thank you. |
|
|
|
|
08-04-2006, 11:19 AM
|
#19 (permalink) |
|
Assistant Manager, TSF Academy; Moderator/Analyst Security Team
Join Date: Jan 2005
Location: Ohio
Posts: 26,591
OS: WinXP and Vista
|
I'm satisfied that the slowness you are experiencing is not malware related.
Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links. Reset hidden/system files and folders Windows XP =============== Click Start. * Open My Computer. * Select the Tools menu and click Folder Options. * Select the View tab. * Deselect the Show hidden files and folders option. * Select the Hide file extensions for known types option. * Select the Hide protected operating system files option. Click Yes to confirm. Click OK. Enable Windows Auto Update *Go to Start>Run - type wuaucpl.cpl *Tick on the checkbox - "Keep my computer up to date" *Under Settings, choose "Automatically download the updates, and install them on the schedule that I specify". Click on "OK". Create a new System Restore point Click Start >> Run - type SYSDM.CPL & press Enter * Select the System Restore Tab * Tick on the checkbox - "Turn off System Restore on all drives" Click Apply * Then untick the same checkbox & click OK This will prevent any reinfection from previous restore points. Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you do not already have them: Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items . Download Spyware Guard to catch and block spyware before it can execute. Download IE-SPYAD.EXE to block access to malicious websites so you cannot be redirected to them from an infected site or email. IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. This is a self-extracting .ZIP file, and save it to your desktop. Once downloaded, double-click on it to extract the files inside (default dir is C:\IE-SPYAD) From within the folder, double-click install.bat Select Option #2 - Install the new IE-SPYAD list, by typing 2 Then return to the main menu. Select option #4 - Add the old porn sites domain, by typing 4 Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles: HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Follow this list and your potential for being infected again will reduce dramatically.  Shall we consider this thread resolved? |
|
|
|
|
08-04-2006, 11:08 PM
|
#20 (permalink) |
|
Registered User
Join Date: Aug 2004
Posts: 24
OS: Win XP
|
Hello Ried,
I have done everything as instructed and I greatly appreciate your prompt replies, help, advice and also your patience. I read the recommended tutorials and also went to Jason levine's toolbox site and did some test on my system. Everything is fine now and yes, ... this thread is resolved. Thank you again. 
|
|
|
|
| Thread Tools | |
|
|
