smit thingy

[scottopoly]

I am infected! Here are logs & scans:



SmitFraudFix v2.117

Scan done at 19:46:57.85, Mon 10/30/2006
Run from C:\Documents and Settings\Family\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\Documents and Settings\Family


C:\Documents and Settings\Family\Application Data

C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusBurster 6.2.lnk FOUND !

Start Menu

C:\DOCUME~1\Family\STARTM~1\VirusBurster 6.2.lnk FOUND !
C:\DOCUME~1\Family\STARTM~1\Programs\VirusBurster FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

C:\DOCUME~1\Family\FAVORI~1


Desktop

C:\DOCUME~1\Family\Desktop\VirusBurster.lnk FOUND !
C:\DOCUME~1\ALLUSE~1\Desktop\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\Desktop\Security Troubleshooting.url FOUND !

C:\Program Files

C:\Program Files\VirusBurster\ FOUND !

Corrupted keys


Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f31aee4a-1530-4fef-8537-79c6973bff9a}"="gaonic"



AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


pe386-msguard-lzx32


Scanning wininet.dll infection


End







Logfile of HijackThis v1.99.1
Scan saved at 7:52:11 PM, on 10/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Network Associates VirusScan\SHSTAT.EXE
C:\Program Files\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates VirusScan\Mcshield.exe
C:\Program Files\Network Associates VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Driver~1\i386\services.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSNBC - Today's News from MSNBC Front Page
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\PowerCodec\isaddon.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusBurster] C:\Program Files\VirusBurster\virusburster.exe /h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: gaonic - {f31aee4a-1530-4fef-8537-79c6973bff9a} - (no file)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Services - Unknown owner - C:\WINDOWS\Driver~1\i386\services.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)




Thank you!!

[Glaswegian]

Hi scottopoly and welcome to TSF.

Apologies for any delay in replying, but we have been rather busy lately, and, of course, all our helpers are volunteers.

We will need to run Smitfraudfix again as there are some additional items within the fix. The tool has also been updated so please delete the version you have just now.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers when you are following the procedures below.

Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your system is clean.



Show Hidden Files
Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.



Downloads
Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!


Download AVG Anti Spyware
This is a 30 day trial

• Install AVG Anti Spyware
• Double-click the icon on Desktop to launch AVG
• On the top of the main screen click Shield
• Click the word active to change it to inactive
• On the top of the main screen click Update.
• Then click on Start Update. The update will start and a progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"
  • I also recommend changing the "Update interval" to something more reasonable like 12 hours.

When you have finished updating, EXIT AVG Anti Spyware.


Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop. Do not use it yet!



Reboot
Reboot your system in Safe Mode.

• Restart the computer. The computer begins processing a set of instructions known as BIOS.
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
• Instead of Windows loading as normal, a menu should appear
• Use the arrow key to highlight Safe Mode and press Enter.

Services
Click Start->Run - type SERVICES.MSC & then click on the OK button

• Locate the service - Services <- - CARE – there may be a legit service called 'Services' running.
• Double-click on it to open the Properties dialog.
  • Under the General tab, note down the name of "Service name". We shall need it later.
• Stop the service by using the Stop button.
• Change the Startup type to Disabled & then click on the OK button

• Then start HiJackThis & go to Config>Misc.Tools...> Delete an NT service...
• In the popup box that appears, type in "Service name", i.e the name of the service you just noted as above, & then click on the OK button

.


HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

O23 - Service: Services - Unknown owner - C:\WINDOWS\Driver~1\i386\services.exe

Please remember to close all other windows, including browsers then click Fix checked.




File Deletions
Delete the following File indicated in RED if it still exists.

C:\WINDOWS\Driver Cache\i386\services.exe




Run SmitfraudFix
Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : " Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question " Replace infected file?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: (C:rapport.txt) or partition where your operating system is installed. Please post that log along with all others requested in your next reply.



Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users
• Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.

Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.


Go to Control Panel click Display > Desktop > Customize Desktop > Web > Now, Uncheck Everything and delete if present:
• "Security Info"
• "Warning Message"
• "Security Desktop"
• "Warning Homepage"
• "Desktop Uninstall"

Also make sure the 'Lock desktop items' box is unticked. Click OK, and then Click Apply, then OK.


Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.




RunAVG Anti Spyware
Run AVG with it's updated definitions:(...it's important that all windows must be closed)

• Click Scanner
• Click on the Scan tab
• Click Complete System Scan to begin scanning.
• When the scan is complete click Recommended Action and change it to Quarantine
• Then click Apply all actions

Once finished, click the Save report button, then click Save Report As and save it to your desktop (make sure to remember where you saved that file, this is important).

NOTE: AVG scan may require an hour.




Reboot
Reboot your system in Normal Mode.




SmitfraudFix - Additional Items
Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
**Note** This will remove all entries in the "Trusted Zone" - if you want them back, you have to add them back to the Trusted Sites again.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.




Online Scan
Perform an online scan with Internet Explorer with Panda ActiveScan

1. Click on located at the bottom of the page.
2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
3. Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*

Begin the scan by selecting

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan



Logs required
rapport.txt
AVG Log
Panda Log
HijackThis Log

Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced only while in Normal Mode.

[scottopoly]

Alright!

Here are some notes as I went along, otherwise everything went as expected:

- Since I am not physically at the computer, I did this all in 'safe mode with network support'. hopefully, that won't affect it.. unless some network files were infected.
- "services" was already stopped when the directions said to stop it..
- this line was not present in hijackthis (perhaps because I just manually removed that service?) "O23 - Service: Services - Unknown owner - C:\WINDOWS\Driver~1\i386\services.exe"
- although i didn't really plan it this way, i restarted the computer before running CleanUp.
- the only thing under "desktop items" was "My Custom Home Page" which was unchecked already and i left it.
- the rapport file I posted below is from the first time the smit program was run, not the second (i assume that's what you wanted).
- when all done ,there was still a virus burster link on the desktop (pointing here: "C:\Program Files\VirusBurster\VirusBurster.exe") which I deleted.
- when all done, I looked through the add-remove programs list and found these three things (they were probably there before too...) but I didn't remove them:
powercodec 4.0
safety alerter 2006
switch uninstall


There you go! Time for round two. Thanks!





Log of SmitFraudFix

SmitFraudFix v2.119

Scan done at 11:52:05.23, Sun 11/05/2006
Run from C:\Documents and Settings\Administrator\Desktop\new files\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f31aee4a-1530-4fef-8537-79c6973bff9a}"="gaonic"


Killing process


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files

C:\DOCUME~1\ALLUSE~1\Desktop\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\Desktop\Security Troubleshooting.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
C:\Program Files\VirusBurster\ Deleted

Deleting Temp Files


Registry Cleaning

Registry Cleaning done.

After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End







---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 2:07:01 PM 11/5/2006

+ Scan result:



HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 -> Adware.IntCodec : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.IntCodec : Cleaned with backup (quarantined).
HKU\S-1-5-21-746137067-413027322-725345543-1003\Software\Internet Security -> Adware.IntCodec : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\gaonic -> Adware.VirusBurst : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033567.exe -> Adware.VirusBurster : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\TypeLib\{A569F6C9-29F0-43BC-80CF-6BA138C66108} -> Adware.VirusBurster : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\VirusBurster -> Adware.VirusBurster : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusBurster -> Adware.VirusBurster : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP103\A0022542.exe/avtemp/setup.exe -> Backdoor.Small.bh : Cleaned with backup (quarantined).
C:\avtemp\setup.exe -> Backdoor.Small.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033542.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033550.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033558.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP240\A0034558.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP241\A0034570.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP241\A0034579.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034612.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034643.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034637.exe -> Downloader.Zlob.art : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033540.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033549.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033557.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP240\A0034557.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP241\A0034568.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP241\A0034577.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034611.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034638.dll -> Downloader.Zlob.aru : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033543.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033551.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP239\A0033559.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP240\A0034560.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP241\A0034571.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP241\A0034580.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034599.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034613.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034639.exe -> Downloader.Zlob.arv : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034640.exe -> Downloader.Zlob.arz : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034641.exe -> Downloader.Zlob.asa : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP243\A0034645.exe -> Downloader.Zlob.asc : Cleaned with backup (quarantined).
C:\WINDOWS\wm_hooks.dll -> Not-A-Virus.RemoteAdmin.Win32.WinVNC.4 : Ignored and added to exceptions
C:\System Volume Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP191\A0027492.exe -> Not-A-Virus.RemoteAdmin.Win32.WinVNC.4110 : Ignored and added to exceptions
:mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.12:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.61:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.62:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.28:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.32:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.35:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.36:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.29:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.27:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.20:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.21:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.22:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.23:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.24:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.25:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.11:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.6:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.38:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.39:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.40:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.41:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o4pco54x.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.


::Report end









Incident Status Location

Dialer:dialer.su Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\uninstall\Switch
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Family\Cookies\family@2o7[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Family\Cookies\family@atdmt[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Family\Cookies\family@doubleclick[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][.hitbox.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][.2o7.net/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][.doubleclick.net/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][.mediaplex.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][.atdmt.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][www.burstbeacon.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][.tribalfusion.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\mmoi4va3.default\cookies.txt][.burstnet.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@2o7[1].txt]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@ads.pointroll[1].txt]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@advertising[1].txt]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@atdmt[1].txt]
Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@centrport[2].txt]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@doubleclick[2].txt]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@hitbox[2].txt]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@mediaplex[1].txt]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@questionmarket[1].txt]
Spyware:Cookie/Rightmedia Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@rightmedia[2].txt]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@servedby.advertising[2].txt]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@trafficmp[2].txt]
Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@valueclick[1].txt]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Family\My Documents\backup from old HD that was switched out\parentsbackup.rar[Documents and Settings\Family\Cookies\family@zedo[2].txt]
Potentially unwanted tool:Application/Processor Not disinfected C:\new files\SmitfraudFix\Process.exe
Possible Virus. Not disinfected C:\new files\SmitfraudFix\swsc.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\new files\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Possible Virus. Not disinfected C:\new files\SmitfraudFix.zip[SmitfraudFix/swsc.exe]
Virus:Trj/ClassLoader.U Disinfected C:\quarantine\archive1213.jar-701bff88-112defd3.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-701bff88-112defd3.zip.Vir[VB.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-701bff88-112defd3.zip.Vir[Dummy.class]
Virus:Trj/Downloader.HAS Disinfected C:\quarantine\archive1213.jar-701bff88-112defd3.zip.Vir[Beyond.class]
Virus:Trj/ClassLoader.U Disinfected C:\quarantine\archive1213.jar-701bff88-2b8202a7.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-701bff88-2b8202a7.zip.Vir[VB.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-701bff88-2b8202a7.zip.Vir[Dummy.class]
Virus:Trj/Downloader.HAS Disinfected C:\quarantine\archive1213.jar-701bff88-2b8202a7.zip.Vir[Beyond.class]
Virus:Trj/ClassLoader.U Disinfected C:\quarantine\archive1213.jar-701bff88-62d57f04.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-701bff88-62d57f04.zip.Vir[VB.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-701bff88-62d57f04.zip.Vir[Dummy.class]
Virus:Trj/Downloader.HAS Disinfected C:\quarantine\archive1213.jar-701bff88-62d57f04.zip.Vir[Beyond.class]
Virus:Trj/ClassLoader.U Disinfected C:\quarantine\archive1213.jar-7c24eef2-3333afda.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-7c24eef2-3333afda.zip.Vir[VB.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-7c24eef2-3333afda.zip.Vir[Dummy.class]
Virus:Trj/Downloader.HAS Disinfected C:\quarantine\archive1213.jar-7c24eef2-3333afda.zip.Vir[Beyond.class]
Virus:Trj/ClassLoader.U Disinfected C:\quarantine\archive1213.jar-7c24eef2-3826b201.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-7c24eef2-3826b201.zip.Vir[VB.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\archive1213.jar-7c24eef2-3826b201.zip.Vir[Dummy.class]
Virus:Trj/Downloader.HAS Disinfected C:\quarantine\archive1213.jar-7c24eef2-3826b201.zip.Vir[Beyond.class]
Virus:Trj/Classloader.I Disinfected C:\quarantine\classload.jar-65695b65-1dfe2557.zip.Vir[b.class]
Hacktool:Exploit/BytVerify Not disinfected C:\quarantine\classload.jar-65695b65-1dfe2557.zip.Vir[c.class]
Hacktool:Exploit/BytVerify Not disinfected C:\quarantine\classload.jar-65695b65-1dfe2557.zip.Vir[a.class]
Virus:Trj/Downloader.DIS Disinfected C:\quarantine\classload.jar-65695b65-1dfe2557.zip.Vir[d.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\classload.jar-da4ff31-5215279e.zip.Vir[GetAccess.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\classload.jar-da4ff31-5215279e.zip.Vir[InsecureClassLoader.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\classload.jar-da4ff31-5215279e.zip.Vir[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\classload.jar-da4ff31-5215279e.zip.Vir[Installer.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-22cd6c3-7da19e74.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-22cd6c3-7da19e74.zip.Vir[VerifierBug.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-22cd6c3-7da19e74.zip.Vir[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-22cd6c3-7da19e74.zip.Vir[Beyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-63b11ab9.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-63b11ab9.zip.Vir[VerifierBug.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-63b11ab9.zip.Vir[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-63b11ab9.zip.Vir[Beyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-7c8411e1.zip.Vir[BlackBox.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-7c8411e1.zip.Vir[VerifierBug.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-7c8411e1.zip.Vir[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\count.jar-691d85e2-7c8411e1.zip.Vir[Beyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\Counters.jar-333fe01c-6d00adea.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\Counters.jar-333fe01c-6d00adea.zip.Vir[Xeyond.class]
Virus:Trj/Downloader.APT Disinfected C:\quarantine\Counters.jar-333fe01c-6d00adea.zip.Vir[web.exe]
Virus:Js/Dragdrop Disinfected C:\quarantine\input[1].php.Vir[C:\quarantine\input[1].php.Vir]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-177d95e9.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-177d95e9.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-177d95e9.zip.Vir[VerifierBug.class]
Spyware:Spyware/Smitfraud Not disinfected C:\quarantine\jar.jar-10b9dd1d-177d95e9.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-177d95e9.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-177d95e9.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-667f48db.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-667f48db.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-667f48db.zip.Vir[VerifierBug.class]
Spyware:Spyware/Smitfraud Not disinfected C:\quarantine\jar.jar-10b9dd1d-667f48db.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-667f48db.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-10b9dd1d-667f48db.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-65bcaa7c.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-65bcaa7c.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-65bcaa7c.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-29defbe1-65bcaa7c.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-65bcaa7c.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-65bcaa7c.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-721f1a84.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-721f1a84.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-721f1a84.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-29defbe1-721f1a84.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-721f1a84.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-29defbe1-721f1a84.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-210d7ebb.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-210d7ebb.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-210d7ebb.zip.Vir[VerifierBug.class]
Virus:Trj/Lowzones.JN Disinfected C:\quarantine\jar.jar-2a0546cb-210d7ebb.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-210d7ebb.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-210d7ebb.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-27462696.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-27462696.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-27462696.zip.Vir[VerifierBug.class]
Virus:Trj/Lowzones.JN Disinfected C:\quarantine\jar.jar-2a0546cb-27462696.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-27462696.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-27462696.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-4e59b890.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-4e59b890.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-4e59b890.zip.Vir[VerifierBug.class]
Virus:Trj/Lowzones.JN Disinfected C:\quarantine\jar.jar-2a0546cb-4e59b890.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-4e59b890.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2a0546cb-4e59b890.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-1c143554.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-1c143554.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-1c143554.zip.Vir[VerifierBug.class]
Virus:Trj/LowZones.RI Disinfected C:\quarantine\jar.jar-2ad522e1-1c143554.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-1c143554.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-1c143554.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-25e34512.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-25e34512.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-25e34512.zip.Vir[VerifierBug.class]
Virus:Trj/LowZones.RI Disinfected C:\quarantine\jar.jar-2ad522e1-25e34512.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-25e34512.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-25e34512.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-4e8aec3f.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-4e8aec3f.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-4e8aec3f.zip.Vir[VerifierBug.class]
Virus:Trj/LowZones.RI Disinfected C:\quarantine\jar.jar-2ad522e1-4e8aec3f.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-4e8aec3f.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-4e8aec3f.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-75cb8e5a.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-75cb8e5a.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-75cb8e5a.zip.Vir[VerifierBug.class]
Virus:Trj/LowZones.RI Disinfected C:\quarantine\jar.jar-2ad522e1-75cb8e5a.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-75cb8e5a.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2ad522e1-75cb8e5a.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2d07aaa2-49941151.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2d07aaa2-49941151.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2d07aaa2-49941151.zip.Vir[VerifierBug.class]
Virus:Trj/Downloader.ICS Disinfected C:\quarantine\jar.jar-2d07aaa2-49941151.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2d07aaa2-49941151.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-2d07aaa2-49941151.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-3f1991e2-3fe7b62e.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-3f1991e2-3fe7b62e.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-3f1991e2-3fe7b62e.zip.Vir[VerifierBug.class]
Virus:Trj/LowZones.RI Disinfected C:\quarantine\jar.jar-3f1991e2-3fe7b62e.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-3f1991e2-3fe7b62e.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-3f1991e2-3fe7b62e.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-521c4f7f-303184af.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-521c4f7f-303184af.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-521c4f7f-303184af.zip.Vir[VerifierBug.class]
Adware:Adware/MediaTickets Not disinfected C:\quarantine\jar.jar-521c4f7f-303184af.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-521c4f7f-303184af.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-521c4f7f-303184af.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-204188b4.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-204188b4.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-204188b4.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-5f5cccb6-204188b4.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-204188b4.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-204188b4.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-2960a8b9.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-2960a8b9.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-2960a8b9.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-5f5cccb6-2960a8b9.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-2960a8b9.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-2960a8b9.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-4755d3e6.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-4755d3e6.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-4755d3e6.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-5f5cccb6-4755d3e6.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-4755d3e6.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-4755d3e6.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-54414dd0.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-54414dd0.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-54414dd0.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-5f5cccb6-54414dd0.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-54414dd0.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-54414dd0.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-6335370a.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-6335370a.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-6335370a.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-5f5cccb6-6335370a.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-6335370a.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-5f5cccb6-6335370a.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-66d293ce-57e2909d.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-66d293ce-57e2909d.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-66d293ce-57e2909d.zip.Vir[VerifierBug.class]
Virus:Trj/Lowzones.JN Disinfected C:\quarantine\jar.jar-66d293ce-57e2909d.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-66d293ce-57e2909d.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-66d293ce-57e2909d.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-451d13ca.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-451d13ca.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-451d13ca.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-73a13bb7-451d13ca.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-451d13ca.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-451d13ca.zip.Vir[Xeyond.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-61cf035c.zip.Vir[Counter.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-61cf035c.zip.Vir[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-61cf035c.zip.Vir[VerifierBug.class]
Possible Virus. Not disinfected C:\quarantine\jar.jar-73a13bb7-61cf035c.zip.Vir[web.exe]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-61cf035c.zip.Vir[Worker.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\quarantine\jar.jar-73a13bb7-61cf035c.zip.Vir[Xeyond.class]






Logfile of HijackThis v1.99.1
Scan saved at 2:53:20 PM, on 11/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates VirusScan\Mcshield.exe
C:\Program Files\Network Associates VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Network Associates VirusScan\SHSTAT.EXE
C:\Program Files\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSNBC - Today's News from MSNBC Front Page
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\PowerCodec\isaddon.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

[Glaswegian]

Hi again

Since I am not physically at the computer, I did this all in 'safe mode with network support'.

If at all possible, please complete the instructions exactly in the way I have described. There are very good reasons for such detailed instructions – in this case, you’ve been lucky – most of it required Safe Mode.

I’m curious – is it your computer? Are you doing all this remotely? How is the system running now?

Anyway, let’s continue…


Please empty this folder

C:\quarantine\



Reboot
Reboot your system in Safe Mode.

• Restart the computer. The computer begins processing a set of instructions known as BIOS.
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
• Instead of Windows loading as normal, a menu should appear
• Use the arrow key to highlight Safe Mode and press Enter.

Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

PowerCodec 4
Safety Alerter 2006
Switch Uninstall



HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\PowerCodec\isaddon.dll (file missing)
O3 - Toolbar: (no name) - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - (no file)

Please remember to close all other windows, including browsers then click Fix checked.



File Deletions
Delete the following Folders indicated in BLUE if they still exist.

C:\Program Files\PowerCodec
C:\Program Files\Safety Alerter 2006
C:\Program Files\Switch


Reboot
Reboot your system in Normal Mode.



Online Scan
Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner

Next Click on Kaspersky Online Scanner


A Welcome screen will appear - click 'Accept' at the bottom. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:

Scan using the following Anti-Virus database:

• Extended

Scan Options:

• Scan Archives
• Scan Mail Bases

Click OK

Now under select a target to scan: Select My Computer

• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

• Save the file to your desktop.
• Copy and paste that information in your next post.

Take note of the name(s) and location(s) of any file(s) it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan


Please post back with the Kaspersky Log and a fresh HijackThis Log. Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced only while in Normal Mode.

[scottopoly]

Well, I believe you misunderstood me.. when I said I did it
"all" in safe mode with network support, I meant that I did all
of the portion that was supposed to be done in plain "safe
mode" rather in "safe mode with network support". The parts
that were to be done in normal mode were done in normal mode.
Indeed it is my parents computer and they do not know their way
around a computer very well so I have been doing this for them
remotely using RealVNC.

The system appears to be running just fine, but I haven't used
it extensively.


- when uninstalling PowerCodec 4, I got the message that says,
"An error occured when trying to uninstall PowerCodec 4, it may
have been already uninstalled. Would you like to remove
PowerCodec 4.0 from the Add or Remove programs list?" I did.

- similar message for Safety Alerter 2006

- Switch Uninstall seemed to actually uninstall.

- I also noticed that SpywareBlaster v3.3 is in the uninstall
list, but I think that may be legitimate.

- powercodec folder was not there
- safety alert folder was not there
- switch folder was not there

- the kaspersky scan did not have a "save as text file" option, so I
pasted it below. I was going to attach it as well, but it seems that I cannot attach html files. It looks like it found a couple actual bad things.

- Again, your time is very much appriciated!




KASPERSKY ONLINE SCANNER REPORT
Sunday, November 05, 2006 9:07:22 PM
Operating System: Microsoft Windows XP Professional, Service
Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 6/11/2006
Kaspersky Anti-Virus database records: 238525


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\

Scan Statistics
Total number of scanned objects 61371
Number of viruses found 6
Number of infected objects 23 / 0
Number of suspicious objects 0
Duration of the scan process 01:05:03

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\341fb9b5dd63fa79e5cd540d1
ac1cdc8_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\702d3add90d41ec698b3f76f9
767a037_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\91ec554d2866780de1e34b1ae
9e65251_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\95e16cb6b9974743671d7d673
ae37a95_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\c852368d563a07cf8fecd1cf1
f6f30bb_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\cd2216e4d37fdff769a32a599
8ee20de_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\d955529ebdc004c2c25f4e57f
41139f2_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application
Data\Microsoft\Crypto\RSA\MachineKeys\e2d599a4d2e96dfb5842527b4
bcb4fb2_ae895e12-5ae3-4543-b4b6-79aa4ad2fa34 Object is locked
skipped

C:\Documents and Settings\All Users\Application Data\Network
Associates\BOPDATA\_Date-20061105_Time-191257750_EnterceptExcep
tions.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Network
Associates\BOPDATA\_Date-20061105_Time-191257750_EnterceptRules
.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Network
Associates\Common Framework\Db\Agent_BAR-COMPUTER.log Object
is locked skipped

C:\Documents and Settings\All Users\Application Data\Network
Associates\Common Framework\Db\PrdMgr_BAR-COMPUTER.log Object
is locked skipped

C:\Documents and Settings\All Users\Application Data\Network
Associates\VirusScan\AccessProtectionLog.txt Object is locked
skipped

C:\Documents and Settings\All Users\Application Data\Network
Associates\VirusScan\BufferOverflowProtectionLog.txt Object is
locked skipped

C:\Documents and Settings\All Users\Application Data\Network
Associates\VirusScan\OnAccessScanLog.txt Object is locked
skipped

C:\Documents and Settings\Family\Cookies\index.dat Object is
locked skipped

C:\Documents and
Settings\Family\Desktop\patch.exe/data.rar/wm_hooks.dll
Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped

C:\Documents and Settings\Family\Desktop\patch.exe/data.rar
Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped

C:\Documents and Settings\Family\Desktop\patch.exe RarSFX:
infected - 2 skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbc2e.ht1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbdam Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbdao Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbeam Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbeao Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbm Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbu2d.ht1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbvm.cf1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\dbvmh.ht1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\fii.cf1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\fiih.ht1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\rpm.cf1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Google\Google Desktop Search\rpmh.ht1 Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Family\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked
skipped

C:\Documents and Settings\Family\Local
Settings\History\History.IE5\index.dat Object is locked
skipped

C:\Documents and Settings\Family\Local Settings\Temporary
Internet Files\Content.IE5\index.dat Object is locked skipped


C:\Documents and Settings\Family\NTUSER.DAT Object is locked
skipped

C:\Documents and Settings\Family\NTUSER.DAT.LOG Object is
locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat
Object is locked skipped

C:\Documents and Settings\LocalService\Local
Settings\Application Data\Microsoft\Windows\UsrClass.dat
Object is locked skipped

C:\Documents and Settings\LocalService\Local
Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
Object is locked skipped

C:\Documents and Settings\LocalService\Local
Settings\History\History.IE5\index.dat Object is locked
skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary
Internet Files\Content.IE5\index.dat Object is locked skipped


C:\Documents and Settings\LocalService\NTUSER.DAT Object is
locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object
is locked skipped

C:\Documents and Settings\NetworkService\Local
Settings\Application Data\Microsoft\Windows\UsrClass.dat
Object is locked skipped

C:\Documents and Settings\NetworkService\Local
Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is
locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object
is locked skipped

C:\new files\SmitfraudFix\Reboot.exe Infected:
not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\new files\SmitfraudFix.zip/SmitfraudFix/Reboot.exe
Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\new files\SmitfraudFix.zip ZIP: infected - 1 skipped

C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected:
not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase
Object is locked skipped

C:\System Volume
Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP19
1\A0027492.exe Infected:
not-a-virus:RemoteAdmin.Win32.WinVNC.4110 skipped

C:\System Volume
Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP24
3\A0034644.exe Infected: Trojan-Downloader.Win32.Zlob.asb
skipped

C:\System Volume
Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP24
5\A0045922.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f
skipped

C:\System Volume
Information\_restore{E8C795A8-053E-4103-95FA-6C5FF9E323ED}\RP24
5\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Driver Cache\i386\env.exe/BAT Infected:
Trojan.BAT.Zapchast skipped

C:\WINDOWS\Driver Cache\i386\env.exe QuickBatch: infected - 1
skipped

C:\WINDOWS\Driver Cache\i386\env.exe Cexe: infected - 1
skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{8F5BE8FE-391E-4822-
8B67-E1AF0BA95E1B}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is
locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped


C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped


C:\WINDOWS\system32\config\AppEvent.Evt Object is locked
skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked
skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked
skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked
skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked
skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked
skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked
skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is
locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is
locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is
locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is
locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is
locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is
locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is
locked skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir0 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir1 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir2 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir3 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir4 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir5 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir6 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\Temp\ASHeuristic\web_exe.vir7 Infected:
Trojan.Win32.Small.ev skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\wm_hooks.dll Infected:
not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped

Scan process completed.











Logfile of HijackThis v1.99.1
Scan saved at 9:15:10 PM, on 11/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates VirusScan\Mcshield.exe
C:\Program Files\Network Associates VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Network Associates VirusScan\SHSTAT.EXE
C:\Program Files\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network
Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Desktop
Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop
Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop
Search\GoogleDesktopOE.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page
= MSNBC - Today's News from MSNBC Front Page
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class -
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F}
- c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network
Associates VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Common
Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service]
"C:\Program Files\Common Files\Network
Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program
Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program
Files\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program
files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word -
res://c:\program
files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program
files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program
files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English -
res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan
Object) -
http://www.kaspersky.com/kos/eng/par...kavwebscan_uni
code.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan
Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: WgaLogon -
C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware
Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware
7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) -
Macrovision Corporation - C:\Program Files\Common
Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) -
Network Associates, Inc. - C:\Program Files\Common
Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network
Associates, Inc. - C:\Program Files\Network Associates
VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager)
- Network Associates, Inc. - C:\Program Files\Network
Associates VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA
Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner -
C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file
missing)

[Glaswegian]

Hi again

Apologies if I misunderstood.

Looking good now though.


Please delete this file (if it still exists)

C:\WINDOWS\Driver Cache\i386\ env.exe

Note: If it resists you may have to boot to safe Mode to delete it.


Run CleanUp! again.


Please choose any one of these online scanners and post back with any log it produces.

Trend Micro - Free online virus Scan <- - you can use Firefox for this scanner
eTrust Antivirus Web Scanner
BitDefender Free Online Virus Scan
McAfee – Computer Anti-Virus Software and Internet Security For Your PC
Symantec Security Check

[scottopoly]

Alright, long story short, I ran three of the scans. I hope you don't mind.. I don't think more scans will hurt.

- ran eTrust Antivirus web scanner. all found files deleted except for the last two that are in the "jar" folder rather than the "file" folder.

- Symantec didn't find anything.

- trend micro found two tracking cookies (no big deal), and also told me that I have security vulnerability as per this webpage: Microsoft Security Bulletin MS06-061: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (924191) I could not copy/paste or save a log with this one, so I have none. I did not install any patches from the microsoft webpage.



eTrust Antivirus Web Scanner

Scan Results: 57714 files scanned. 20 viruses were detected.

File Infection Status Path
Anima.class-1a960417-704e4253.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-24af51dc-536a1395.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-2626fb5d-7ea0a6bc.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-2c12fd96-225f6bd1.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-2dce4db4-3aa70635.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-2fdccaaf-4f7391c2.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-35e076df-712327ba.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-37483d49-6edfd26e.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-3eceafa-13455e07.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-450385f4-4fda37a7.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-48c536c8-7b8a6cf6.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-4f75fe7d-66a06fa2.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-56807f73-72b055a1.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-600ce773-5866d850.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-60f2f7fc-570f1713.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-684c241a-2fdb97f9.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-71b00ee0-12a2b09a.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
Anima.class-7b0adf11-3c747e0e.class Java/ByteVerify!exploit infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\
eRT.jar-14e46f0-1a97f172.zip>HiPointInstallShieldRT.class Java/Shinwow.BH infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\
nRT.jar-4e3272d0-2b3482cf.zip>HiPointInstallShieldRT.class Java/Shinwow.BH infected C:\Documents and Settings\Family\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\






Symantec:


50246 files scanned, 0 file(s) infected on your disk drives.

No viruses were detected in memory.

Your computer is free of known threats. Virus Detection does not check compressed files.

[Glaswegian]

Hi again

That's a recent patch - always make sure the system is kept up to date. Have a look at this MS Article on how to configure Automatic Updates.

See this page for instructions on how to clear java's cache.


Other than that, your log is clean. Any more problems? If not we’ll just tidy up and I’ll let you go, along with my recommendations for staying safe and secure.

You can go ahead and delete any special tools we used (SmitRem, SmitfraudFix, ComboFix, etc). They won't serve a future purpose and are replaced with updated versions frequently, so the copies you have are probably already out of date and there is therefore no need to keep them.



Reset Hidden/System Files
To reset your hidden and system files:

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

System Restore
To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree
SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen. Note that SnoopFree is only for XP systems.


MVPS Hosts File
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera
Maxthon



Firewalls
A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Sygate Personal Firewall
ZoneAlarm
Tiny Personal Firewall


Anti Virus Software
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are three very good free Antivirus products which are available:
BitDefender Free
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection
Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

PC Safety & Security - What Do I Need?.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.

[scottopoly]

Alright, all done. Thanks!!!