Windows Defender tells me I have ardamax keylogger, is it lying?

[fullcircle]

Hi,

I hope someone can help me. When I have real time protection turned on in Windows defender beta 2 it tells me, shortly after my machine is started that I have Ardamax Keylogger on my machine, if I tell it to remove it I get a succeeded response but on reboot the same message appears, If I turn off real time protection, reboot and then scan with Defender it doesn't find it. I've scanned with everything I can get my hands on, including the recommendations here, and nothing apart from a few cookies is showing up, Here is my HijackThis Log, any ideas?

Logfile of HijackThis v1.99.1
Scan saved at 17:31:24, on 02/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\InternetProgs\WindowsDefenderBeta2\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\INTERN~1\AVG\avgamsvr.exe
D:\INTERN~1\AVG\avgupsvc.exe
D:\INTERN~1\AVG\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
D:\Utils\DisKeeper\DkService.exe
D:\Utils\ewido anti-spyware 4.0\guard.exe
D:\InternetProgs\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\pestpatrol\ppRemoteService.exe
C:\WINDOWS\System32\SnoopFreeSvc.exe
C:\WINDOWS\system32\svchost.exe
D:\InternetProgs\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
D:\INTERN~1\AVG\avgcc.exe
D:\Utils\Logitech\iTouch\iTouch.exe
D:\InternetProgs\Personal Firewall 4\kpf4gui.exe
C:\Program Files\UPHClean\uphclean.exe
D:\InternetProgs\SunJava5.0_08\bin\jusched.exe
D:\Utils\HP7660\HP Software Update\HPWuSchd2.exe
D:\Utils\Logitech\MouseWare\system\em_exec.exe
D:\CDWriting\Roxio9\Media Experience\DMXLauncher.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\Sys\Explorer.exe
D:\InternetProgs\WindowsDefenderBeta2\MSASCui.exe
C:\WINDOWS\SnoopFreeUI.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Utils\CreativeMediaSource\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Utils\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Utils\WinTV\Ir.exe
C:\WINDOWS\system32\HPZipm12.exe
D:\InternetProgs\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Utils\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\InternetProgs\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\InternetProgs\SunJava5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] D:\Utils\HP7660\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [Enterra Icon Keeper] "D:\Utils\Icon Keeper\IcnKeepr.exe" ssp /s
O4 - HKLM\..\Run: [AVG7_CC] D:\INTERN~1\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Utils\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [DiskeeperSystray] "D:\Utils\DisKeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\InternetProgs\SunJava5.0_08\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] D:\Utils\HP7660\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DMXLauncher] "D:\CDWriting\Roxio9\Media Experience\DMXLauncher.exe"
O4 - HKLM\..\Run: [Explorer] C:\WINDOWS\system32\Sys\Explorer.exe
O4 - HKLM\..\Run: [Windows Defender] "D:\InternetProgs\WindowsDefenderBeta2\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Creative Detector] D:\Utils\CreativeMediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] D:\Utils\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [3DCal32@3DCAL32.INI] D:\Utils\3DCal32\3DCal32.exe /C D:\Utils\3DCal32\3DCAL32.INI
O4 - Global Startup: AutoStart IR.lnk = D:\Utils\WinTV\Ir.exe
O4 - Global Startup: Shortcut to E-mail.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\InternetProgs\SunJava5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\InternetProgs\SunJava5.0_08\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1152527656912
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.62/code/iPIX-ImageWell-ipix.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: textwareilluminatorbase - {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\WINDOWS\system32\textwareilluminatorbaseProtocol.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winbee32 - winbee32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\INTERN~1\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\INTERN~1\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\INTERN~1\AVG\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - D:\Utils\DisKeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Utils\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\InternetProgs\Personal Firewall 4\kpf4ss.exe
O23 - Service: PestPatrol Remote - Computer Associates International, Inc. - C:\Program Files\Common Files\pestpatrol\ppRemoteService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\InternetProgs\Spy Sweeper\WRSSSDK.exe

[fredmh]

Hello fullcircle, and welcome to TSF.


I am currently reviewing your log. Please note that this is under the supervision of an expert analyst,
and I will be back with a fix for your problem as soon as possible.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.

Please be patient with me during this time.

[fullcircle]

Thanks for looking at my problem fredmh

look forward to receiving your help

[fredmh]

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.


IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

DOWNLOADS


ATF CLEANER

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

AVG ANTI-SPYWARE 7.5

Note: AVG has purchased Ewido. Please uninstall Ewido anti-spyware 4.0 using Add/Remove and install AVG A/S

Please download AVG Anti-Spyware 7.5

1. Install AVG Anti-Spyware 7.5.
2. Double-click the icon on Desktop to launch AVG A-S 7.5
3. On the top of the main screen click Shield
4. Click the word active to change it to inactive
5. On the top of the main screen click Update.
6. Then click on Start Update. The update will start and a progress bar will show the updates being installed.
7. I also recommend changing the "Update interval" to something more reasonable like 12 hours.

----------------------------------------

DISABLE ANTI-SPYWARE APPLICATIONS

Please disable these Anti-Spyware programs as they may interfere with this fix. You may re-enable them after we clean your system.


Windows Defender

Please disable your Windows Defender Real-time Protection, as it may hinder the removal of some entries.

• Open Windows Defender.
• Click on Tools>Options.
• Scroll down and uncheck "Use real-time protection (recommended)".
• After you uncheck this, click on the Save button and close Windows Defender.

DISABLE WEBROOT SPY SWEEPER


To disable SpySweeper Shields:

Open it, click -> Options over to the left then -> click the Program tab -> uncheck "Start Spy Sweeper at Windows startup".

Over to the left click "Shields":

• Click Internet Explorer tab and uncheck all items.
• Click Windows System tab and uncheck all items.
• Click Hosts File tab and uncheck all items.
• Click Startup Programs tab and uncheck all items.
• Close SpySweeper.

----------------------------------------

FILE SUBMISSIONS


Please go to: VirusTotal

• At the top of the page you'll find a "Browse" button. Click the "Browse" button and browse to this file in BOLD:
  
  
  C:\WINDOWS\system32\Sys\Explorer.exe
  
• Click "Open".
• Then click the "Send" button at the top of the VirusTotal page.
• This will scan the file. Please be patient.
• Once scanned, copy and paste the results in your next reply together with a new HijackThis log.

Please also take a peek inside this folder, and if there are any other files present, submit them to VirusTotal for scanning also. Then repeat as above.

C:\WINDOWS\system32\Sys

----------------------------------------

SAFE MODE RE-BOOT

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list).
In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)


04 - HKLM\..\Run: [Explorer] C:\WINDOWS\system32\Sys\Explorer.exe
O20 - Winlogon Notify: winbee32 - winbee32.dll (file missing)


Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

RUNNING SCANNERS


ATF CLEANER

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.


If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.


Click Exit on the Main menu to close the program


AVG Anti-Spyware 7.5

• Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
  This scan can take quite a while to run, so be prepared.
• Click Scanner
• Click on the Scan tab
• Click Complete System Scan to begin scanning.
• When the scan is complete click Recommended Action and change it to Quarantine.
• Then click Apply all actions.

Once finished, click the Save report button, then click Save Report As and save it to your desktop.


Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------
SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

ON-LINE SCANS


Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner

1. Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on See report then click Save report

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

Create an uninstall list:

• Open HiJackThis
• Click on the configure button on the bottom right
• Click on the tab "Misc Tools"
• Click on the Box that says "Open Uninstall Manager"
• Click on the button "Save list"
• Copy and past the List from the notepad file into your post

----------------------------------------

FOLLOW-UP

Please return and post these items:


AVG A/S scan
Panda scan
Uninstall list
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

[fullcircle]

Hi fredmh

I've been through your list, doesn't look like defender was lying does it :-)

requested info follows

Virus Total scan for

C:\WINDOWS\system32\Sys\Explorer.exe

STATUS: FINISHEDComplete scanning result of "Explorer.exe", received in VirusTotal at 10.05.2006, 18:41:26 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.22 10.05.2006 HEUR/Malware
Authentium 4.93.8 10.05.2006 no virus found
Avast 4.7.892.0 10.05.2006 Win32:Ardamax-AG
AVG 386 10.04.2006 no virus found
BitDefender 7.2 10.05.2006 no virus found
CAT-QuickHeal 8.00 10.05.2006 no virus found
ClamAV devel-20060426 10.05.2006 no virus found
DrWeb 4.33 10.05.2006 no virus found
eTrust-InoculateIT 23.73.14 10.05.2006 no virus found
eTrust-Vet 30.3.3115 10.05.2006 no virus found
Ewido 4.0 10.05.2006 no virus found
Fortinet 2.82.0.0 10.05.2006 no virus found
F-Prot 3.16f 10.04.2006 no virus found
F-Prot4 4.2.1.29 10.04.2006 no virus found
Ikarus 0.2.65.0 10.05.2006 no virus found
Kaspersky 4.0.2.24 10.05.2006 no virus found
McAfee 4867 10.05.2006 New Malware.b
Microsoft 1.1603 10.05.2006 no virus found
NOD32v2 1.1791 10.05.2006 a variant of Win32/KeyLogger.Ardamax
Norman 5.80.02 10.05.2006 no virus found
Panda 9.0.0.4 10.04.2006 Application/Ardamax
Sophos 4.10.0 10.05.2006 no virus found
Symantec 8.0 10.04.2006 no virus found
TheHacker 6.0.1.092 10.05.2006 no virus found
UNA 1.83 10.05.2006 no virus found
VBA32 3.11.1 10.05.2006 no virus found
VirusBuster 4.3.7:9 10.05.2006 no virus found


Aditional Information
File size: 470528 bytes
MD5: 897d9baaec16e826271a294e3f76467b
SHA1: bcf3e07b97ba883e8c07c729682fd227bb5a5f5a

To save a bit of space here, there are two other files in that sys folder,

explorer.001
explorer.002

scans of both files came up with "no virus found"
___________________________________________


---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 22:39:18 05/10/2006

+ Scan result:



S:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP315\A0043495.exe -> Not-A-Virus.Hacktool.EvID : Cleaned with backup (quarantined).
H:\MP3 Toys 25\MP3Toys25Setup.exe -> Not-A-Virus.Monitor.Win32.Ardamax.k : Cleaned with backup (quarantined).



::Report end

________________________

Uninstall list

3D Calendar 5.0
Ad-Aware SE Personal
Adobe InDesign CS
Adobe Photoshop CS
Adobe Reader 7.0.5
Adobe Shockwave Player
Advanced Font Viewer 2.3
Advanced X Video Converter
Alien Skin Eye Candy 5 Impact
Alien Skin Eye Candy 5 Nature
Alien Skin Eye Candy 5 Textures
All To MP3 Converter 1.34.2
Aquarium Desktop
ArtIcons Pro
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
Audio Conversion Wizard 1.4
Audio DVD Creator 1.9.1.0
AVG Anti-Spyware 7.5
AVG Free Edition
Cambridge Advanced Learner's Dictionary
CloneDVDmobile
ConvertXtoDVD 2.0.13
CopyToDVD 4
Creative MediaSource
Creative Removable Disk Manager
Creative System Information
Creative Zen Vision M
Diskeeper Professional Premier Edition
DivX
Dream Aquarium
DVD2one V2.0.5
DVD43 v3.7.0
EmEditor v3
Enterra Icon Keeper 1.0
FairStars Audio Converter 1.46
FUJIFILM USB Driver
GdiplusUpgrade
Google Earth Pro
Google Toolbar for Internet Explorer
Hauppauge WinTV Infrared Remote
Hauppauge WinTV Radio
Hauppauge WinTV2000
HijackThis 1.99.1
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows XP (KB896344)
HP Memories Disc
HP Software Update
HTML-Kit
Ipswitch WS_FTP Professional 2006
J2SE Runtime Environment 5.0 Update 8
jv16 PowerTools 2005
JVC GC-A50
Kerio Personal Firewall
KODAK Camera Connection Software
KODAK Camera Connection Software Help
KODAK Memory Albums
KODAK One Touch to Better Pictures
KODAK Picture Software
KODAK Picture Transfer Software
KODAK Software Updater
Logitech Desktop Messenger
Logitech iTouch Software
Logitech MouseWare 9.79.1
Macromedia Flash Player 8
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Calculator Plus
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)
NATATA Anti-Spam Encoder 1.0
Nero 7 Demo
Ninotech Path Copy 4.0
overland
Panda ActiveScan
PestPatrol Corporate Edition v5
Photosmart 140,240,7200,7600,7700,7900 Series
PowerISO
Quick Batch File Compiler 2.0.7.0
Roxio Easy Media Creator 8 Suite
Roxio Easy Media Creator 9 Suite
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB925486)
Shareaza version 2.2.1.0
SightSpeed (remove only)
SoundMAXWDM
Spy Sweeper
Spybot - Search & Destroy 1.4
SpyHunter
SyncToy
System Requirements Lab
Tag&Rename 3.2
Tweak UI
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
User Profile Hive Cleanup Service
VideoLAN VLC media player 0.8.5
webcamXP (remove only)
WinAVIVideoConverter
Windows Defender
Windows Defender Signatures
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
XoftSpy

____________________________________

PANDA ACTIVE SCAN REPORT



Incident Status Location
Potentially unwanted tool:Application/Ardamax Not disinfected C:\WINDOWS\system32\Sys\Explorer.exe
___________________________________________________

NEW HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 01:28:07, on 06/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\InternetProgs\WindowsDefenderBeta2\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\Utils\AVG Anti-Spyware 7.5\guard.exe
D:\INTERN~1\AVG\avgamsvr.exe
D:\INTERN~1\AVG\avgupsvc.exe
D:\INTERN~1\AVG\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
D:\Utils\DisKeeper\DkService.exe
D:\InternetProgs\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\pestpatrol\ppRemoteService.exe
D:\InternetProgs\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\svchost.exe
D:\InternetProgs\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
D:\Utils\Logitech\iTouch\iTouch.exe
D:\Utils\Logitech\MouseWare\system\em_exec.exe
D:\InternetProgs\SunJava5.0_08\bin\jusched.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
D:\Utils\HP7660\HP Software Update\HPWuSchd2.exe
D:\CDWriting\Roxio9\Media Experience\DMXLauncher.exe
D:\InternetProgs\WindowsDefenderBeta2\MSASCui.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Utils\CreativeMediaSource\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Utils\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Utils\WinTV\Ir.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\HPZipm12.exe
D:\InternetProgs\Personal Firewall 4\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
D:\Utils\EmEditor\EMEDITOR.EXE
D:\Utils\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\InternetProgs\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\InternetProgs\SunJava5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] D:\Utils\HP7660\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [Enterra Icon Keeper] "D:\Utils\Icon Keeper\IcnKeepr.exe" ssp /s
O4 - HKLM\..\Run: [AVG7_CC] D:\INTERN~1\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Utils\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [DiskeeperSystray] "D:\Utils\DisKeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\InternetProgs\SunJava5.0_08\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] D:\Utils\HP7660\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DMXLauncher] "D:\CDWriting\Roxio9\Media Experience\DMXLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "D:\InternetProgs\WindowsDefenderBeta2\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Utils\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Creative Detector] D:\Utils\CreativeMediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] D:\Utils\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [3DCal32@3DCAL32.INI] D:\Utils\3DCal32\3DCal32.exe /C D:\Utils\3DCal32\3DCAL32.INI
O4 - Global Startup: AutoStart IR.lnk = D:\Utils\WinTV\Ir.exe
O4 - Global Startup: Shortcut to E-mail.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\InternetProgs\SunJava5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\InternetProgs\SunJava5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1152527656912
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...61/mcfscan.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.62/code/iPIX-ImageWell-ipix.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: textwareilluminatorbase - {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\WINDOWS\system32\textwareilluminatorbaseProtocol.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Utils\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\INTERN~1\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\INTERN~1\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\INTERN~1\AVG\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - D:\Utils\DisKeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\InternetProgs\Personal Firewall 4\kpf4ss.exe
O23 - Service: PestPatrol Remote - Computer Associates International, Inc. - C:\Program Files\Common Files\pestpatrol\ppRemoteService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\InternetProgs\Spy Sweeper\WRSSSDK.exe


Hope this is what you require

thanks

fullcircle

[fullcircle]

bump

don't mean to be impatient fredmh, just want to make sure you haven't lost me

[fredmh]

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\WINDOWS\system32\Sys

----------------------------------------

P2P - I see you have P2P software (i.e. shareaza) installed on your machine. We are not here to pass judgment on file-sharing
as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you
more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

----------------------------------------

Kaspersky - Extended

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
  We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items:


Kaspersky scan

[fullcircle]

Thanks fredmh

I've just finished the scan but I noticed that a lot of bits in the email section were skipped, I had OE open while it was scanning, I guess that was the problem, it took 5 hours to complete so I'm going to rerun it over night with nothing else open, so I'll get back to you with the log tomorrow, thanks for your continued and prompt help, its most appreciated

full circle

[fullcircle]

Hi fredmh

Kaspersky log follows:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, October 08, 2006 10:54:19 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 7/10/2006
Kaspersky Anti-Virus database records: 229821
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\
N:\
S:\

Scan Statistics:
Total number of scanned objects: 288283
Number of viruses found: 3
Number of infected objects: 2 / 0
Number of suspicious objects: 0
Duration of the scan process: 04:10:03

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\15383b3fb369f75e90e676b3b4625bcd_b81e9a12-2ac3-4743-afda-32ca9824f815 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\17af5b477914d63ed7dfa8518e5d9788_b81e9a12-2ac3-4743-afda-32ca9824f815 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a946319303d6335cddf309fa49368152_b81e9a12-2ac3-4743-afda-32ca9824f815 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b09128b6bda3542cbe2114aeb4ef29fd_b81e9a12-2ac3-4743-afda-32ca9824f815 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-07132006-231318.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\History\History.IE5\MSHist012006100720061008\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\Perflib_Perfdata_534.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\Perflib_Perfdata_98c.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF810D.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF8318.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~ROMFN_000006C4 Object is locked skipped
C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\User\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\drivers\sptd6157.sys Object is locked skipped
C:\WINDOWS\system32\drivers\vaxscsi.sys Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_f4.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\debug.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\debug.log.idx Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\error.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\error.log.idx Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\hips.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\hips.log.idx Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\ids.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\ids.log.idx Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\network.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\network.log.idx Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\system.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\system.log.idx Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\warning.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\warning.log.idx Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\web.log Object is locked skipped
D:\InternetProgs\Personal Firewall 4\logs\web.log.idx Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\change.log Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\chandir.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\chandir.idx Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\chn.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\chn.idx Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\D0000000.FCS Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\inuse.txt Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\L0000002.FCS Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\main.log Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs.idx Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_die.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_die.idx Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_dnd.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_dnd.idx Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_ext.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_ext.idx Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_rcv.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\prs_rcv.idx Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\storydb.dat Object is locked skipped
D:\Utils\Logitech\Desktop Messenger\8876480\Users\User\Data\storydb.idx Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\change.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\change.log Object is locked skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\change.log Object is locked skipped
G:\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
H:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP346\A0044608.exe Infected: not-a-virus:Monitor.Win32.Ardamax.k skipped
H:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\change.log Object is locked skipped
S:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
S:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\A0044779.exe Infected: not-virus:Hoax.Win32.Renos.fh skipped
S:\System Volume Information\_restore{F92C9E9C-D6E3-414B-BD8D-F2FCCA3149D8}\RP348\change.log Object is locked skipped

Scan process completed.

[fredmh]

Looks like we got the keylogger. Your logs are now clean. Please complete the next "housekeeping" steps and read through the
information which follows

----------------------------------------


Clear IE's Cookies and Cache

• Close all instances of Outlook Express and Internet Explorer.
• Go to Control Panel » Internet Options » General tab.
• Click the Delete Cookies.
• Next to it, Click the Delete Files button.
• When prompted, place a check in: Delete all offline content, click OK.

Clean Temporary Files

• Go to Start » Run » type: cleanmgr » OK.
• Choose (C:) and then click OK.
• Make sure these are the only ones that are checked :
  • Temporary Internet Files
  • Temporary Files
  • Recycle Bin
• Click OK to remove them.
• Click Yes to confirm the deletion.

CLEAR AVG A/S QUARANTINE

• Launch AVG A/S
• Click on Show Quarantine
• Click on Select All
• Click on Remove Finally
• Close AVG A/S

Windows XP - Reset Hidden Files

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore

• To turn off System Restore click Start > Right Click My Computer > Properties.
• Click the System Restore tab and Check
• "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
• When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.
  
  
• Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
• Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
• Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.


KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.


ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".


TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.

• Install & update SpywareBlaster with the latest definitions.
• After you have updated, click the button - enable protection for all unprotected items

SpywareGuard to catch and block spyware before it can execute.


SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here


AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here


IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

• Download IE-SpyAD - Extract the contents to a new folder
• From within the folder, double-click install.bat
• Select Option #2 - Install the new IE-SPYAD list.
• Then return to the main menu.
• Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here


MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.

• Download Host.zip to your desktop.
• From your Desktop right-click (hosts.zip) and select:
  Extract All from the menu.
  
• Click Next, click Next, select the option:
  "Show Extracted files"
• Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.


MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.


ANTI-VIRUS AND FIREWALL PROGRAMS


ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:

• Avast!
  
• AVG
  

If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls

• ZoneAlarm
• Avast Antivirus/Firewall
• Tiny Personal Firewall
• OutPost Firewall

INFORMATIONAL READING


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:

• PC SAFETY AND SECURITY
• HOW DID I GET INFECTED IN THE FIRST PLACE?
• THE ANTI-SPYWARE TUTORIAL
• MAKING INTERNET EXPLORER SAFER
• INVASION OF THE COMPUTER SNATCHERS
• The Cookie Concept

Please respond one more time and let me know you received this post so it can be marked resolved

[fullcircle]

Thank you fredmh

I am so grateful for the time and effort you have taken to share your knowledge and fix my problem, as you said my machine appears to be clean now and defender is no longer telling me about the ardamax logger

I have carried out the housekeeping comments and will now go and check out some of the programs you mentioned that I don't already have

once more......THANK YOU

full circle

[fullcircle]

Hi fredmh

Just thought you might like to know that your list of recommended applications has a couple of dead links

IE-Spyad doesn't work

also the McAfee Site Adviser link isn't working, it appears to have a double http:// in the address

neither of these is a problem for me, I've found my way to both of them, but thought you might be interested for future recommendations

once again

thank you for your help

fullcircle

[fredmh]

Glad I could help. Happy surfing.