virus that sends outgoing mail that symantec tries to block

noxnoctis123 · 06-07-2007, 10:52 AM

ive been having tons of outgoing emails i havent sent and symantec has brought scanning email popups by the hundreds trying to stop them
please help
this all started with dl from a site and at first i also had many popups please help

StartupList report, 6/7/2007, 12:49:23 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
vptray = C:\PROGRA~1\SYMANT~1\VPTray.exe
SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
DVDTray = C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
Windows Defender = "C:\Program Files\Windows Defender\MSASCui.exe" -hide
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\system32\huxotuyb.dll (file missing) - {4B646AFB-9341-4330-8FD1-C32485AEE619}
(no name) - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - (no file) - {7E853D72-626A-48EC-A868-BA8D5E23E045}
(no name) - C:\WINDOWS\system32\ddcbaba.dll (file missing) - {8071E65A-3F56-4426-8372-8667CD213057}
(no name) - C:\WINDOWS\system32\pmnnl.dll (file missing) - {8A9A419E-432E-4C20-9EF5-8AC3FA13F892}

--------------------------------------------------

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job
MP Scheduled Scan.job

--------------------------------------------------

Enumerating Download Program Files:

[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Office Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\OGACheckControl.DLL
CODEBASE = http://go.microsoft.com/fwlink/?linkid=58813

[iPIX ActiveX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\ipixx.ocx
CODEBASE = http://www.ipix.com/viewers/ipixx.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/s...irector/sw.cab

[Microsoft Genuine Advantage Self Support Tool]
InProcServer32 = C:\WINDOWS\system32\SelfHelpControl.DLL
CODEBASE = http://go.microsoft.com/fwlink/?LinkId=82580

[MSN Photo Upload Tool]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll
CODEBASE = http://by123fd.bay123.hotmail.msn.co...s/MsnPUpld.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
End of report, 5,828 bytes
Report generated in 0.250 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

sUBs · 06-09-2007, 12:02 AM

1. Download this file -> http://download.bleepingcomputer.com...a/ComboFix.exe

2. Double click on combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

noxnoctis123 · 06-09-2007, 03:11 PM

well i havent had any pop ups lately
and before u sent this i tried a virus scanner called Kaspersky and it found some massive email virus attached to winlogon and quarintined it but i deleted that program cause it was just a trial but my computer is still without error so thank you but ill repost if it pops up again
so heres the logs

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:08:04 PM, on 6/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A9A419E-432E-4C20-9EF5-8AC3FA13F892} - C:\WINDOWS\system32\pmnnl.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.co...s/MsnPUpld.cab
O20 - Winlogon Notify: ÈØ - ÈØ (file missing)
O20 - Winlogon Notify: Èx€ - Èx€ (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 4681 bytes

ComboFix 07-06-09.4
"hiei" - 2007-06-09 17:01:40 - Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 )))))))))))))))))))))))))))))))

2007-06-09 16:52 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-06-09 16:52 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-06-09 16:52 <DIR> d-------- C:\Program Files\Symantec AntiVirus
2007-06-09 16:12 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-08 17:45 <DIR> d-------- C:\WINDOWS\pss
2007-06-08 15:55 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-06-08 15:46 <DIR> d-------- C:\KAV
2007-06-07 22:05 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Viewpoint
2007-06-07 22:04 <DIR> d-------- C:\Program Files\Viewpoint
2007-06-07 22:04 <DIR> d-------- C:\Program Files\AOD
2007-06-07 22:04 <DIR> d-------- C:\Program Files\AIM
2007-06-07 22:04 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Aim
2007-06-07 22:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-06-06 14:05 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-06-06 14:05 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-06-05 12:34 <DIR> d-------- C:\Program Files\RegistryFix
2007-06-05 01:37 <DIR> d-------- C:\Program Files\CDisplay
2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-06-04 17:40 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-06-04 16:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-04 14:04 <DIR> d-------- C:\DOCUME~1\hiei\.housecall6.6
2007-06-03 23:21 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-06-03 23:21 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2007-06-03 23:21 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2007-06-03 23:21 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2007-06-03 23:21 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2007-06-03 23:21 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2007-06-03 23:21 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2007-06-03 23:21 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2007-06-03 23:21 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll
2007-06-03 21:39 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-06-03 21:38 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Lavasoft
2007-06-03 17:32 <DIR> d-------- C:\Program Files\QuickTime
2007-06-02 01:34 303,616 --a------ C:\WINDOWS\system32\drivers\BLKWGDv7.sys
2007-06-02 01:34 <DIR> d-------- C:\WINDOWS\OPTIONS
2007-06-02 01:34 <DIR> d-------- C:\Program Files\Belkin
2007-05-29 20:48 <DIR> d--hs---- C:\WINDOWS\CSC
2007-05-29 13:14 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-05-29 01:02 <DIR> d-------- C:\Program Files\Windows Defender
2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\AVSMedia
2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\River Past G5
2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5
2007-05-28 15:41 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-05-22 15:32 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-05-11 18:15 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2007-05-11 18:15 638,976 --a------ C:\WINDOWS\system32\divx.dll
2007-05-11 18:15 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-05-11 18:15 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-05-11 18:15 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
2007-05-11 18:15 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-05-11 18:15 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2007-05-11 18:15 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2007-05-11 16:54 <DIR> d-------- C:\Restoration
2007-05-09 03:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2038-03-14 14:15:43 -------- d-----w C:\Program Files\Common Files\ODBC
2038-03-14 14:15:39 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-06-09 20:53:51 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-09 20:52:54 -------- d-----w C:\Program Files\Symantec
2007-06-08 01:04:45 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Azureus
2007-06-05 16:53:40 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-05 15:26:16 -------- d-----w C:\Program Files\Common Files\LightScribe
2007-06-03 21:29:29 -------- d-----w C:\Program Files\Apple Software Update
2007-05-31 00:18:14 -------- d-----w C:\Program Files\Messenger
2007-05-07 20:45:20 -------- d-----w C:\Program Files\MSN Messenger
2007-05-07 20:22:40 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\MSNInstaller
2007-05-07 19:46:20 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\vlc
2007-05-07 19:01:37 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-05-07 16:26:07 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-07 05:53:02 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-07 05:49:16 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-07 05:48:02 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-07 05:47:51 -------- d-----w C:\Program Files\Movie Maker
2007-05-07 05:46:25 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-07 05:45:27 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-07 05:45:15 -------- d-----w C:\Program Files\Windows NT
2007-04-22 03:05:54 1,314 ----a-w C:\WINDOWS\system32\tmp.reg
2007-04-21 21:37:19 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Apple Computer
2007-04-21 03:09:26 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Ahead
2007-04-21 03:07:13 -------- d-----w C:\Program Files\Ahead
2007-04-21 03:01:45 -------- d-----w C:\Program Files\Common Files\Nero
2007-04-21 02:58:22 -------- d-----w C:\Program Files\Common Files\Ahead
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-04-11 21:30:01 -------- d--h--w C:\DOCUME~1\hiei\APPLIC~1\Move Networks
2007-04-11 21:08:49 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-04-11 20:28:56 0 --sha-r C:\MSDOS.SYS
2007-04-11 20:28:56 0 --sha-r C:\IO.SYS
2007-04-11 20:28:56 0 ----a-w C:\CONFIG.SYS
2007-04-11 20:28:56 0 ----a-w C:\AUTOEXEC.BAT
2007-04-10 22:12:30 -------- d-----w C:\Program Files\Zune
2007-04-10 22:12:04 -------- d-----w C:\Program Files\DIFX
2007-04-10 22:11:33 -------- d-----w C:\Program Files\Common Files\ComponentOne
2007-03-17 13:45:03 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{8A9A419E-432E-4C20-9EF5-8AC3FA13F892}=C:\WINDOWS\system32\pmnnl.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"DVDTray"="C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 04:58]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-10 18:02]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-12-30 14:19]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ ÈØ]
ÈØ

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Èx€]
Èx€

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

*Newly Created Service* - CCSETMGR
*Newly Created Service* - DEFWATCH
*Newly Created Service* - SAVRT
*Newly Created Service* - SAVRTPEL
*Newly Created Service* - SYMANTEC_ANTIVIRUS

Contents of the 'Scheduled Tasks' folder
2007-06-03 20:24:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-09 06:02:00 C:\WINDOWS\tasks\MP Scheduled Scan.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-09 17:03:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-06-09 17:05:03
C:\ComboFix-quarantined-files.txt ... 2007-06-09 17:04
C:\ComboFix2.txt ... 2007-06-09 16:28

--- E O F ---

sUBs · 06-09-2007, 04:27 PM

Quote:

i tried a virus scanner called Kaspersky and it found some massive email virus attached to winlogon and quarintined it but i deleted that program cause it was just a trial

You should have considered keeping it. Kaspersky is one of the most respected scanners.

-----------

Go to Start → Control Panel → Add or Remove Programs and uninstall the following programs:

ViewPoint

Please note any other programs that you dont recognize in that list in your next response

---------------

Do a HijackThis scan & place a check next to these items and select "Fix checked":

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A9A419E-432E-4C20-9EF5-8AC3FA13F892} - C:\WINDOWS\system32\pmnnl.dll (file missing)
O20 - Winlogon Notify: EO - EO (file missing)
O20 - Winlogon Notify: Ex? - Ex? (file missing)

---------------

Open notepad and copy/paste the text in the quotebox below into it:

Code:

Folder::
C:\DOCUME~1\hiei\APPLIC~1\Viewpoint
C:\Program Files\Viewpoint
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

Save this as ComboFix-Do.txt

Refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe
Then post the resultant log

---------------

Please perform an online scan using Internet Explorer at this website - http://www.bitdefender.com/scan8/ie.html

Under SCANNING OPTIONS, use the following Settings:

Action options - Report only
Second option - Report only

Once finished, click on the Details button to view the results.
To the upper right of the results you will see an option saying "Click here to export the scan results" Post the log of the scan results in your next reply

---------------

In your next post, please include fresh logs from:

Fresh Hijackthis log taken just before replying

Online scan

ComboFix's log

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

noxnoctis123 · 06-09-2007, 09:36 PM

thank you for helping me
heres the logs you asked for
I also got rid of viewpoint as you said.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:32:51 PM, on 6/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Zune\Zune.exe
C:\Program Files\Zune\ZuneEnc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 4910 bytes

ComboFix 07-06-09.5 - C:\Documents and Settings\hiei\Desktop\ComboFix.exe
"hiei" - 2007-06-09 22:04:36 - Service Pack 2 NTFS
Command switches used :: C:\ComboFix-Do.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\hiei\APPLIC~1\Viewpoint
C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\URLCache.ini
C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\URLCache.ini
C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1673612820.mtj&p2=1&p3=14753184174104371009044620017471&p4=0
C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\URLCache.ini
C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\URLCache.ini
C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\UpdateVersionList_v2.mtx
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr_0305001C.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt

((((((((((((((((((((((((( Files Created from 2007-05-10 to 2007-06-10 )))))))))))))))))))))))))))))))

2007-06-09 16:52 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-06-09 16:52 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-06-09 16:52 <DIR> d-------- C:\Program Files\Symantec AntiVirus
2007-06-09 16:12 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-08 17:45 <DIR> d-------- C:\WINDOWS\pss
2007-06-08 15:55 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-06-08 15:46 <DIR> d-------- C:\KAV
2007-06-07 22:04 <DIR> d-------- C:\Program Files\AOD
2007-06-07 22:04 <DIR> d-------- C:\Program Files\AIM
2007-06-07 22:04 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Aim
2007-06-06 14:05 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-06-06 14:05 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-06-05 12:34 <DIR> d-------- C:\Program Files\RegistryFix
2007-06-05 01:37 <DIR> d-------- C:\Program Files\CDisplay
2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-06-04 17:40 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-06-04 16:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-04 14:04 <DIR> d-------- C:\DOCUME~1\hiei\.housecall6.6
2007-06-03 23:21 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-06-03 23:21 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2007-06-03 23:21 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2007-06-03 23:21 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2007-06-03 23:21 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2007-06-03 23:21 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2007-06-03 23:21 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2007-06-03 23:21 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2007-06-03 23:21 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll
2007-06-03 21:39 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-06-03 21:38 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Lavasoft
2007-06-03 17:32 <DIR> d-------- C:\Program Files\QuickTime
2007-06-02 01:34 303,616 --a------ C:\WINDOWS\system32\drivers\BLKWGDv7.sys
2007-06-02 01:34 <DIR> d-------- C:\WINDOWS\OPTIONS
2007-06-02 01:34 <DIR> d-------- C:\Program Files\Belkin
2007-05-29 20:48 <DIR> d--hs---- C:\WINDOWS\CSC
2007-05-29 13:14 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-05-29 01:02 <DIR> d-------- C:\Program Files\Windows Defender
2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\AVSMedia
2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\River Past G5
2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5
2007-05-28 15:41 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-05-22 15:32 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-05-11 18:15 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2007-05-11 18:15 638,976 --a------ C:\WINDOWS\system32\divx.dll
2007-05-11 18:15 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-05-11 18:15 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll
2007-05-11 18:15 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
2007-05-11 18:15 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-05-11 18:15 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2007-05-11 18:15 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2007-05-11 16:54 <DIR> d-------- C:\Restoration
2007-05-09 03:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2038-03-14 14:15:43 -------- d-----w C:\Program Files\Common Files\ODBC
2038-03-14 14:15:39 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-06-09 20:53:51 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-09 20:52:54 -------- d-----w C:\Program Files\Symantec
2007-06-08 01:04:45 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Azureus
2007-06-05 16:53:40 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-05 15:26:16 -------- d-----w C:\Program Files\Common Files\LightScribe
2007-06-03 21:29:29 -------- d-----w C:\Program Files\Apple Software Update
2007-05-31 00:18:14 -------- d-----w C:\Program Files\Messenger
2007-05-07 20:45:20 -------- d-----w C:\Program Files\MSN Messenger
2007-05-07 20:22:40 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\MSNInstaller
2007-05-07 19:46:20 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\vlc
2007-05-07 19:01:37 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-05-07 16:26:07 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-07 05:53:02 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-07 05:49:16 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-07 05:48:02 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-07 05:47:51 -------- d-----w C:\Program Files\Movie Maker
2007-05-07 05:46:25 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-07 05:45:27 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-07 05:45:15 -------- d-----w C:\Program Files\Windows NT
2007-04-22 03:05:54 1,314 ----a-w C:\WINDOWS\system32\tmp.reg
2007-04-21 21:37:19 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Apple Computer
2007-04-21 03:09:26 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Ahead
2007-04-21 03:07:13 -------- d-----w C:\Program Files\Ahead
2007-04-21 03:01:45 -------- d-----w C:\Program Files\Common Files\Nero
2007-04-21 02:58:22 -------- d-----w C:\Program Files\Common Files\Ahead
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-04-11 21:30:01 -------- d--h--w C:\DOCUME~1\hiei\APPLIC~1\Move Networks
2007-04-11 21:08:49 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-04-11 20:28:56 0 --sha-r C:\MSDOS.SYS
2007-04-11 20:28:56 0 --sha-r C:\IO.SYS
2007-04-11 20:28:56 0 ----a-w C:\CONFIG.SYS
2007-04-11 20:28:56 0 ----a-w C:\AUTOEXEC.BAT
2007-04-10 22:12:30 -------- d-----w C:\Program Files\Zune
2007-04-10 22:12:04 -------- d-----w C:\Program Files\DIFX
2007-04-10 22:11:33 -------- d-----w C:\Program Files\Common Files\ComponentOne
2007-03-17 13:45:03 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"DVDTray"="C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 04:58]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-10 18:02]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-12-30 14:19]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

*Newly Created Service* - CCSETMGR
*Newly Created Service* - DEFWATCH
*Newly Created Service* - SAVRT
*Newly Created Service* - SAVRTPEL
*Newly Created Service* - SYMANTEC_ANTIVIRUS

Contents of the 'Scheduled Tasks' folder
2007-06-03 20:24:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-09 06:02:00 C:\WINDOWS\tasks\MP Scheduled Scan.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-09 22

43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-09 22:07:38
C:\ComboFix-Do.txt ... 2007-06-09 22:02
C:\ComboFix-quarantined-files.txt ... 2007-06-09 22:07
C:\ComboFix2.txt ... 2007-06-09 17:05
C:\ComboFix3.txt ... 2007-06-09 16:28

--- E O F ---

<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner -Scan Report</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<meta name="generator" content="Namo WebEditor v5.0(Trial)">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >

<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
BitDefender
Online Scanner
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>
<tr>
<td colspan="3" width="912">
Scan report generated
at: Sat, Jun 09, 2007 - 23:08:07
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
Scan
path: A:\;C:\;D:\;E:\;F:\;
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Statistics
</td>
</tr>
<tr>
<td width="57%">
Time
</td>
<td width="43%" align="right">
00:54:38
</td>
</tr>
<tr>
<td width="57%">
Files
</td>
<td width="43%" align="right">
132628
</td>
</tr>
<tr>
<td width="57%">
Folders
</td>
<td width="43%" align="right">
3085
</td>
</tr>
<tr>
<td width="57%">
Boot Sectors
</td>
<td width="43%" align="right">
4
</td>
</tr>
<tr>
<td width="57%">
Archives
</td>
<td width="43%" align="right">
784
</td>
</tr>
<tr>
<td width="57%">
Packed Files
</td>
<td width="43%" align="right">
3469
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Results
</td>
</tr>
<tr>
<td width="57%">
Identified Viruses 
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Infected Files 
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Suspect Files 
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Warnings
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Disinfected
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Deleted Files
</td>
<td width="43%" align="right">
0
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Engines Info
</td>
</tr>
<tr>
<td width="57%">
Virus Definitions
</td>
<td width="43%" align="right">
512746
</td>
</tr>
<tr>
<td width="57%">
Engine build
</td>
<td width="43%" align="right">
AVCORE v1.0 (build 2409) (i386) (May 9 2007 18:01:21)
</td>
</tr>
<tr>
<td width="57%">
Scan plugins
</td>
<td width="43%" align="right">
14
</td>
</tr>
<tr>
<td width="57%">
Archive plugins
</td>
<td width="43%" align="right">
38
</td>
</tr>
<tr>
<td width="57%">
Unpack plugins
</td>
<td width="43%" align="right">
6
</td>
</tr>
<tr>
<td width="57%">
E-mail plugins
</td>
<td width="43%" align="right">
6
</td>
</tr>
<tr>
<td width="57%">
System plugins
</td>
<td width="43%" align="right">
1
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Scan Settings
</td>
</tr>
<tr>
<td width="57%">
First Action
</td>
<td width="43%" align="right">
Disinfect
</td>
</tr>
<tr>
<td width="57%">
Second Action
</td>
<td width="43%" align="right">
Delete
</td>
</tr>
<tr>
<td width="57%">
Heuristics
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Enable Warnings
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scanned Extensions
</td>
<td width="43%" align="right">
*;
</td>
</tr>

<tr>
<td width="57%">
Exclude Extensions
</td>
<td width="43%" align="right">
 
</td>
</tr>
<tr>
<td width="57%">
Scan Emails
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Archives
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Packed
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Files
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
<tr>
<td width="57%">
Scan Boot
</td>
<td width="43%" align="right">
Yes
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td colspan=2>  
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
Scanned File
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
 Status
</td>
</tr>
<tr>
<td width="57%">
No virus found.
</td>
<td width="43%" align="left">
 
</td>
</tr>
</table>
</td>

<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

</table>
 

</body>
</html>

sUBs · 06-09-2007, 09:51 PM

Quote:

BitDefender Online Scanner
Scan report generated at: Sat, Jun 09, 2007 - 23:08:07
Scan path: A:\;C:\;D:\;E:\;F:\;
Statistics
Time 00:54:38
Files 132628
Folders 3085
Boot Sectors 4
Archives 784
Packed Files 3469
Results
Identified Viruses 0
Infected Files 0
Suspect Files 0
Warnings 0

It doesn't really get better than this.

-------------------

Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
Go to Start → Run → type control sysdm.cpl,,4 & press Enter
- Tick on the checkbox - Turn off System Restore on all drives
- Click Apply
Turn it back 'On' by unticking the same checkbox & click OK
DISABLE THE VIEWING OF SYSTEM FILES
From Windows Explorer, go to Tools>Folder Options> View tab.
- Untick - Show hidden files and folder
- Tick - Hide file extensions for known types
- Tick - Hide protected operating system files
Click Yes to confirm & then click OK
SECURING INTERNET EXPLORER
From within Internet Explorer click on the Tools menu and then click on Internet Options.
- Select the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Select Custom Level .
    - Change 'Download signed ActiveX controls' to Prompt
    - Change 'Download unsigned ActiveX controls' to Disable
    - Change 'Initialize and script ActiveX controls not marked as safe' to Disable
    - Change 'Installation of desktop items' to Prompt
    - Change 'Launching programs and files in an IFRAME' to Prompt
    - Change 'Navigate sub-frames across different domains' to Prompt
    - When all these changes have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Select OK to exit the Internet Properties page.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources → http://www.bleepingcomputer.com/forums/topict405.html

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
FIREWALL
Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here → http://www.bleepingcomputer.com/forums/tutorial60.html
Microsoft Windows Update → http://www.windowsupdate.com
Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SPYBOT - SEARCH & DESTROY
Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial43.html
AD-AWARE
Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial48.html
SPYWAREBLASTER
SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial49.html
IE-SPYAD
IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here http://www.spywarewarrior.com/uiuc/resource.htm

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

http://www.trillian.cc → Trillian or http://www.miranda-im.com → Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
http://toolbar.google.com/ - Google Toolbar - Get the free google toolbar to help stop pop up windows.
http://cleanup.stevengould.org/ - CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
http://www.winpatrol.com/ -Winpatrol - Download and install the free version of Winpatrol.
A tutorial for this product is located here: http://www.winpatrol.com/features.html

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Please respond to this thread one more time so we can mark this thread as resolved.

noxnoctis123 · 06-09-2007, 10:08 PM

Well thank you very much I have no issues anymore. I just reopened my windows defender which i think kaspersky shut down for some reason.
Well my computer is running smooth and i havent seen 1 pop up in days so
my problem is def. resolved.
thanks again

06-07-2007, 10:52 AM	#1 (permalink)
noxnoctis123 Registered User Join Date: Jun 2007 Posts: 4 OS: xp sp2	virus that sends outgoing mail that symantec tries to block ive been having tons of outgoing emails i havent sent and symantec has brought scanning email popups by the hundreds trying to stop them please help this all started with dl from a site and at first i also had many popups please help StartupList report, 6/7/2007, 12:49:23 PM StartupList version: 1.52.2 Started from : C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.exe -------------------------------------------------- Listing of startup folders: Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" vptray = C:\PROGRA~1\SYMANT~1\VPTray.exe SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe DVDTray = C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe Windows Defender = "C:\Program Files\Windows Defender\MSASCui.exe" -hide QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=INI section not found SCRNSAVE.EXE=INI section not found drivers=INI section not found Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr drivers=Registry value not found Policies Shell key: HKCU\..\Policies: Shell=Registry value not found HKLM\..\Policies: Shell=Registry value not found -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:\WINDOWS\system32\huxotuyb.dll (file missing) - {4B646AFB-9341-4330-8FD1-C32485AEE619} (no name) - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (no name) - (no file) - {7E853D72-626A-48EC-A868-BA8D5E23E045} (no name) - C:\WINDOWS\system32\ddcbaba.dll (file missing) - {8071E65A-3F56-4426-8372-8667CD213057} (no name) - C:\WINDOWS\system32\pmnnl.dll (file missing) - {8A9A419E-432E-4C20-9EF5-8AC3FA13F892} -------------------------------------------------- Enumerating Task Scheduler jobs: AppleSoftwareUpdate.job MP Scheduled Scan.job -------------------------------------------------- Enumerating Download Program Files: [QuickTime Object] InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab [Office Genuine Advantage Validation Tool] InProcServer32 = C:\WINDOWS\system32\OGACheckControl.DLL CODEBASE = http://go.microsoft.com/fwlink/?linkid=58813 [iPIX ActiveX Control] InProcServer32 = C:\WINDOWS\DOWNLO~1\ipixx.ocx CODEBASE = http://www.ipix.com/viewers/ipixx.cab [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\system32\macromed\Director\SwDir.dll CODEBASE = http://download.macromedia.com/pub/s...irector/sw.cab [Microsoft Genuine Advantage Self Support Tool] InProcServer32 = C:\WINDOWS\system32\SelfHelpControl.DLL CODEBASE = http://go.microsoft.com/fwlink/?LinkId=82580 [MSN Photo Upload Tool] InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll CODEBASE = http://by123fd.bay123.hotmail.msn.co...s/MsnPUpld.cab -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\system32\webcheck.dll SysTray: C:\WINDOWS\system32\stobject.dll WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll -------------------------------------------------- End of report, 5,828 bytes Report generated in 0.250 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only

06-09-2007, 12:02 AM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,460 OS: N/A	Re: virus that sends outgoing mail that symantec tries to block 1. Download this file -> http://download.bleepingcomputer.com...a/ComboFix.exe 2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall __________________ Question - what have you done for the community today?

06-09-2007, 03:11 PM	#3 (permalink)
noxnoctis123 Registered User Join Date: Jun 2007 Posts: 4 OS: xp sp2	Re: virus that sends outgoing mail that symantec tries to block well i havent had any pop ups lately and before u sent this i tried a virus scanner called Kaspersky and it found some massive email virus attached to winlogon and quarintined it but i deleted that program cause it was just a trial but my computer is still without error so thank you but ill repost if it pops up again so heres the logs Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 5:08:04 PM, on 6/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8A9A419E-432E-4C20-9EF5-8AC3FA13F892} - C:\WINDOWS\system32\pmnnl.dll (file missing) O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.co...s/MsnPUpld.cab O20 - Winlogon Notify: ÈØ - ÈØ (file missing) O20 - Winlogon Notify: Èx€ - Èx€ (file missing) O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 4681 bytes ComboFix 07-06-09.4 "hiei" - 2007-06-09 17:01:40 - Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 ))))))))))))))))))))))))))))))) 2007-06-09 16:52 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-09 16:52 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-06-09 16:52 <DIR> d-------- C:\Program Files\Symantec AntiVirus 2007-06-09 16:12 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-08 17:45 <DIR> d-------- C:\WINDOWS\pss 2007-06-08 15:55 <DIR> d-------- C:\Program Files\Kaspersky Lab 2007-06-08 15:46 <DIR> d-------- C:\KAV 2007-06-07 22:05 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Viewpoint 2007-06-07 22:04 <DIR> d-------- C:\Program Files\Viewpoint 2007-06-07 22:04 <DIR> d-------- C:\Program Files\AOD 2007-06-07 22:04 <DIR> d-------- C:\Program Files\AIM 2007-06-07 22:04 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Aim 2007-06-07 22:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint 2007-06-06 14:05 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll 2007-06-06 14:05 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll 2007-06-05 12:34 <DIR> d-------- C:\Program Files\RegistryFix 2007-06-05 01:37 <DIR> d-------- C:\Program Files\CDisplay 2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBRC.dat 2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBFC.dat 2007-06-04 17:40 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-06-04 16:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-06-04 14:04 <DIR> d-------- C:\DOCUME~1\hiei\.housecall6.6 2007-06-03 23:21 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll 2007-06-03 23:21 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll 2007-06-03 23:21 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll 2007-06-03 23:21 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll 2007-06-03 23:21 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll 2007-06-03 23:21 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll 2007-06-03 23:21 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll 2007-06-03 23:21 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll 2007-06-03 23:21 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll 2007-06-03 21:39 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-06-03 21:38 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Lavasoft 2007-06-03 17:32 <DIR> d-------- C:\Program Files\QuickTime 2007-06-02 01:34 303,616 --a------ C:\WINDOWS\system32\drivers\BLKWGDv7.sys 2007-06-02 01:34 <DIR> d-------- C:\WINDOWS\OPTIONS 2007-06-02 01:34 <DIR> d-------- C:\Program Files\Belkin 2007-05-29 20:48 <DIR> d--hs---- C:\WINDOWS\CSC 2007-05-29 13:14 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2007-05-29 01:02 <DIR> d-------- C:\Program Files\Windows Defender 2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\AVSMedia 2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU 2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\River Past G5 2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5 2007-05-28 15:41 <DIR> d-------- C:\Program Files\Common Files\Download Manager 2007-05-22 15:32 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-05-11 18:15 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2007-05-11 18:15 638,976 --a------ C:\WINDOWS\system32\divx.dll 2007-05-11 18:15 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-05-11 18:15 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-05-11 18:15 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-05-11 18:15 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-05-11 18:15 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2007-05-11 18:15 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-05-11 16:54 <DIR> d-------- C:\Restoration 2007-05-09 03:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2038-03-14 14:15:43 -------- d-----w C:\Program Files\Common Files\ODBC 2038-03-14 14:15:39 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-06-09 20:53:51 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-06-09 20:52:54 -------- d-----w C:\Program Files\Symantec 2007-06-08 01:04:45 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Azureus 2007-06-05 16:53:40 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-05 15:26:16 -------- d-----w C:\Program Files\Common Files\LightScribe 2007-06-03 21:29:29 -------- d-----w C:\Program Files\Apple Software Update 2007-05-31 00:18:14 -------- d-----w C:\Program Files\Messenger 2007-05-07 20:45:20 -------- d-----w C:\Program Files\MSN Messenger 2007-05-07 20:22:40 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\MSNInstaller 2007-05-07 19:46:20 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\vlc 2007-05-07 19:01:37 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2007-05-07 16:26:07 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-07 05:53:02 -------- d-----w C:\Program Files\microsoft frontpage 2007-05-07 05:49:16 -------- d--h--w C:\Program Files\WindowsUpdate 2007-05-07 05:48:02 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-05-07 05:47:51 -------- d-----w C:\Program Files\Movie Maker 2007-05-07 05:46:25 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-05-07 05:45:27 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-05-07 05:45:15 -------- d-----w C:\Program Files\Windows NT 2007-04-22 03:05:54 1,314 ----a-w C:\WINDOWS\system32\tmp.reg 2007-04-21 21:37:19 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Apple Computer 2007-04-21 03:09:26 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Ahead 2007-04-21 03:07:13 -------- d-----w C:\Program Files\Ahead 2007-04-21 03:01:45 -------- d-----w C:\Program Files\Common Files\Nero 2007-04-21 02:58:22 -------- d-----w C:\Program Files\Common Files\Ahead 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2007-04-11 21:30:01 -------- d--h--w C:\DOCUME~1\hiei\APPLIC~1\Move Networks 2007-04-11 21:08:49 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-04-11 20:28:56 0 --sha-r C:\MSDOS.SYS 2007-04-11 20:28:56 0 --sha-r C:\IO.SYS 2007-04-11 20:28:56 0 ----a-w C:\CONFIG.SYS 2007-04-11 20:28:56 0 ----a-w C:\AUTOEXEC.BAT 2007-04-10 22:12:30 -------- d-----w C:\Program Files\Zune 2007-04-10 22:12:04 -------- d-----w C:\Program Files\DIFX 2007-04-10 22:11:33 -------- d-----w C:\Program Files\Common Files\ComponentOne 2007-03-17 13:45:03 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {8A9A419E-432E-4C20-9EF5-8AC3FA13F892}=C:\WINDOWS\system32\pmnnl.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "DVDTray"="C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 04:58] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-10 18:02] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-12-30 14:19] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ ÈØ] ÈØ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Èx€] Èx€ HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost netsvcs Newly Created Service - CCSETMGR Newly Created Service - DEFWATCH Newly Created Service - SAVRT Newly Created Service - SAVRTPEL Newly Created Service - SYMANTEC_ANTIVIRUS Contents of the 'Scheduled Tasks' folder 2007-06-03 20:24:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job 2007-06-09 06:02:00 C:\WINDOWS\tasks\MP Scheduled Scan.job ************************************************************************ catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-09 17:03:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************ Completion time: 2007-06-09 17:05:03 C:\ComboFix-quarantined-files.txt ... 2007-06-09 17:04 C:\ComboFix2.txt ... 2007-06-09 16:28 --- E O F ---

06-09-2007, 09:36 PM	#5 (permalink)
noxnoctis123 Registered User Join Date: Jun 2007 Posts: 4 OS: xp sp2	Re: virus that sends outgoing mail that symantec tries to block thank you for helping me heres the logs you asked for I also got rid of viewpoint as you said. Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 11:32:51 PM, on 6/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\Program Files\Zune\Zune.exe C:\Program Files\Zune\ZuneEnc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\hiei\Desktop\HiJackThis_v2.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 4910 bytes ComboFix 07-06-09.5 - C:\Documents and Settings\hiei\Desktop\ComboFix.exe "hiei" - 2007-06-09 22:04:36 - Service Pack 2 NTFS Command switches used :: C:\ComboFix-Do.txt ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\hiei\APPLIC~1\Viewpoint C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\URLCache.ini C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\URLCache.ini C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\-1673612820.mtj&p2=1&p3=14753184174104371009044620017471&p4=0 C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\URLCache.ini C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\URLCache.ini C:\DOCUME~1\hiei\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\UpdateVersionList_v2.mtx C:\Program Files\Viewpoint C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0305000D.dll C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr_0305001C.dll C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll C:\Program Files\Viewpoint\Viewpoint Media Player\DownLoadHist.ini C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe C:\Program Files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt ((((((((((((((((((((((((( Files Created from 2007-05-10 to 2007-06-10 ))))))))))))))))))))))))))))))) 2007-06-09 16:52 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-09 16:52 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-06-09 16:52 <DIR> d-------- C:\Program Files\Symantec AntiVirus 2007-06-09 16:12 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-08 17:45 <DIR> d-------- C:\WINDOWS\pss 2007-06-08 15:55 <DIR> d-------- C:\Program Files\Kaspersky Lab 2007-06-08 15:46 <DIR> d-------- C:\KAV 2007-06-07 22:04 <DIR> d-------- C:\Program Files\AOD 2007-06-07 22:04 <DIR> d-------- C:\Program Files\AIM 2007-06-07 22:04 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Aim 2007-06-06 14:05 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll 2007-06-06 14:05 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll 2007-06-05 12:34 <DIR> d-------- C:\Program Files\RegistryFix 2007-06-05 01:37 <DIR> d-------- C:\Program Files\CDisplay 2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBRC.dat 2007-06-05 00:23 0 --a------ C:\WINDOWS\system32\SBFC.dat 2007-06-04 17:40 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2007-06-04 16:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-06-04 14:04 <DIR> d-------- C:\DOCUME~1\hiei\.housecall6.6 2007-06-03 23:21 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll 2007-06-03 23:21 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll 2007-06-03 23:21 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll 2007-06-03 23:21 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll 2007-06-03 23:21 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll 2007-06-03 23:21 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll 2007-06-03 23:21 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll 2007-06-03 23:21 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll 2007-06-03 23:21 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll 2007-06-03 21:39 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-06-03 21:38 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\Lavasoft 2007-06-03 17:32 <DIR> d-------- C:\Program Files\QuickTime 2007-06-02 01:34 303,616 --a------ C:\WINDOWS\system32\drivers\BLKWGDv7.sys 2007-06-02 01:34 <DIR> d-------- C:\WINDOWS\OPTIONS 2007-06-02 01:34 <DIR> d-------- C:\Program Files\Belkin 2007-05-29 20:48 <DIR> d--hs---- C:\WINDOWS\CSC 2007-05-29 13:14 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2007-05-29 01:02 <DIR> d-------- C:\Program Files\Windows Defender 2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\AVSMedia 2007-05-29 00:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU 2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\hiei\APPLIC~1\River Past G5 2007-05-28 19:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5 2007-05-28 15:41 <DIR> d-------- C:\Program Files\Common Files\Download Manager 2007-05-22 15:32 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-05-11 18:15 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2007-05-11 18:15 638,976 --a------ C:\WINDOWS\system32\divx.dll 2007-05-11 18:15 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-05-11 18:15 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-05-11 18:15 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-05-11 18:15 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-05-11 18:15 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2007-05-11 18:15 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-05-11 16:54 <DIR> d-------- C:\Restoration 2007-05-09 03:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2038-03-14 14:15:43 -------- d-----w C:\Program Files\Common Files\ODBC 2038-03-14 14:15:39 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-06-09 20:53:51 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-06-09 20:52:54 -------- d-----w C:\Program Files\Symantec 2007-06-08 01:04:45 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Azureus 2007-06-05 16:53:40 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-05 15:26:16 -------- d-----w C:\Program Files\Common Files\LightScribe 2007-06-03 21:29:29 -------- d-----w C:\Program Files\Apple Software Update 2007-05-31 00:18:14 -------- d-----w C:\Program Files\Messenger 2007-05-07 20:45:20 -------- d-----w C:\Program Files\MSN Messenger 2007-05-07 20:22:40 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\MSNInstaller 2007-05-07 19:46:20 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\vlc 2007-05-07 19:01:37 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2007-05-07 16:26:07 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-07 05:53:02 -------- d-----w C:\Program Files\microsoft frontpage 2007-05-07 05:49:16 -------- d--h--w C:\Program Files\WindowsUpdate 2007-05-07 05:48:02 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-05-07 05:47:51 -------- d-----w C:\Program Files\Movie Maker 2007-05-07 05:46:25 21,640 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-05-07 05:45:27 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-05-07 05:45:15 -------- d-----w C:\Program Files\Windows NT 2007-04-22 03:05:54 1,314 ----a-w C:\WINDOWS\system32\tmp.reg 2007-04-21 21:37:19 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Apple Computer 2007-04-21 03:09:26 -------- d-----w C:\DOCUME~1\hiei\APPLIC~1\Ahead 2007-04-21 03:07:13 -------- d-----w C:\Program Files\Ahead 2007-04-21 03:01:45 -------- d-----w C:\Program Files\Common Files\Nero 2007-04-21 02:58:22 -------- d-----w C:\Program Files\Common Files\Ahead 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2007-04-11 21:30:01 -------- d--h--w C:\DOCUME~1\hiei\APPLIC~1\Move Networks 2007-04-11 21:08:49 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-04-11 20:28:56 0 --sha-r C:\MSDOS.SYS 2007-04-11 20:28:56 0 --sha-r C:\IO.SYS 2007-04-11 20:28:56 0 ----a-w C:\CONFIG.SYS 2007-04-11 20:28:56 0 ----a-w C:\AUTOEXEC.BAT 2007-04-10 22:12:30 -------- d-----w C:\Program Files\Zune 2007-04-10 22:12:04 -------- d-----w C:\Program Files\DIFX 2007-04-10 22:11:33 -------- d-----w C:\Program Files\Common Files\ComponentOne 2007-03-17 13:45:03 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "DVDTray"="C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 04:58] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-10 18:02] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-12-30 14:19] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost netsvcs Newly Created Service - CCSETMGR Newly Created Service - DEFWATCH Newly Created Service - SAVRT Newly Created Service - SAVRTPEL Newly Created Service - SYMANTEC_ANTIVIRUS Contents of the 'Scheduled Tasks' folder 2007-06-03 20:24:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job 2007-06-09 06:02:00 C:\WINDOWS\tasks\MP Scheduled Scan.job ************************************************************************ catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-09 2243 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 2007-06-09 22:07:38 C:\ComboFix-Do.txt ... 2007-06-09 22:02 C:\ComboFix-quarantined-files.txt ... 2007-06-09 22:07 C:\ComboFix2.txt ... 2007-06-09 17:05 C:\ComboFix3.txt ... 2007-06-09 16:28 --- E O F --- <HTML> <HEAD> <TITLE>BitDefender Online Scanner -Scan Report</TITLE> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <meta name="generator" content="Namo WebEditor v5.0(Trial)"> </HEAD> <BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" > <table align="center" border="0" cellpadding="0" cellspacing="0" width="90%"> <tr> <td width="458"> <p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender Online Scanner</b></span></font></p> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td colspan="3" width="912"> <p><font face="Arial"><span style="font-size:11pt;"><B>Scan report generated at: Sat, Jun 09, 2007 - 23:08:07</b></span></font></p> </td> </tr> <tr> <td width="458"> <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <p><font face="Arial"><span style="font-size:11pt;"><B>Scan path: </b></span><span style="font-size:10pt;">A:\;C:\;D:\;E:\;F:\;</span></font></p> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%"> <tr> <td width="451" colspan="2" bgcolor="#CCCCCC"> <p><font face="Arial" size="2"><B>Statistics</b></font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Time</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">00:54:38</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Files</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">132628</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Folders</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">3085</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Boot Sectors</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">4</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Archives</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">784</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Packed Files</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">3469</font></p> </td> </tr> </table> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%"> <tr> <td width="451" colspan="2" bgcolor="#CCCCCC"> <p><font face="Arial" size="2"><B>Results</b></font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Identified Viruses </font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">0</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Infected Files </font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">0</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Suspect Files </font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">0</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Warnings</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">0</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Disinfected</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">0</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Deleted Files</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">0</font></p> </td> </tr> </table> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%"> <tr> <td width="451" colspan="2" bgcolor="#CCCCCC"> <p><font face="Arial" size="2"><B>Engines Info</b></font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Virus Definitions</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">512746</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Engine build</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">AVCORE v1.0 (build 2409) (i386) (May 9 2007 18:01:21)</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Scan plugins</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">14</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Archive plugins</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">38</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Unpack plugins</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">6</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">E-mail plugins</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">6</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">System plugins</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">1</font></p> </td> </tr> </table> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%"> <tr> <td width="451" colspan="2" bgcolor="#CCCCCC"> <p><font face="Arial" size="2"><B>Scan Settings</b></font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">First Action</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Disinfect</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Second Action</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Delete</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Heuristics</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Yes</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Enable Warnings</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Yes</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Scanned Extensions</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">*;</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Exclude Extensions</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2"> </font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Scan Emails</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Yes</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Scan Archives</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Yes</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Scan Packed</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Yes</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Scan Files</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Yes</font></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">Scan Boot</font></p> </td> <td width="43%" align="right"> <p><font face="Arial" size="2">Yes</font></p> </td> </tr> </table> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td colspan=2>   <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%"> <tr> <td width="252" bgcolor="#CCCCCC"> <p><font face="Arial" size="2"><B>Scanned File</b></font></p> </td> <td width="195" bgcolor="#CCCCCC" align="right"> <p align="left"><b><font size="2" face="Arial"> Status</font></b></p> </td> </tr> <tr> <td width="57%"> <p><font face="Arial" size="2">No virus found.</font></p> </td> <td width="43%" align="left"> <p><font face="Arial" size="2"> </font></p> </td> </tr> </table> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> <tr> <td width="458"> <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p> </td> <td width="40%"> <p> </p> </td> <td width="10%"> <p> </p> </td> </tr> </table> <p> </p> </body> </html>

06-09-2007, 10:08 PM	#7 (permalink)
noxnoctis123 Registered User Join Date: Jun 2007 Posts: 4 OS: xp sp2	Re: virus that sends outgoing mail that symantec tries to block Well thank you very much I have no issues anymore. I just reopened my windows defender which i think kaspersky shut down for some reason. Well my computer is running smooth and i havent seen 1 pop up in days so my problem is def. resolved. thanks again