|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-30-2007, 11:14 PM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2005
Posts: 70
OS: xp
|
Worm virus Problem
My wife downloaded some add-ons for the Sims 2 game.
I think that's where the virus came from. The kaspersky scan really scared me. It won't even fit in one post :( I left a part in the middle out, it's all in the folder documents and settings/me/shared. The part that is missing I put in some periods like this: ................ ................ ................ This is a folder that is full of stuff I don't know and it can all go, I just didn't want to delete it because I was afraid that might make it worse. I also did an Adaware scan and a Spybot scan and they both removed some things but I forgot to make a copy of the report. Anyway I want to thank you all in advance for helping me, I appreciate it. Here's the Hijackthis log: [Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 11:02:13 PM, on 8/30/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\AT&T\DSL\programs\dslpca.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE C:\WINDOWS\system32\wltray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HiJackThis_v2.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AT&T DSL Service PCA Program] C:\Program Files\AT&T\DSL\programs\dslpca.exe /ws O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [EPSON Stylus C84 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P32 "EPSON Stylus C84 Series (Copy 1)" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186528708672 O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 5447 bytes ] Kaspersky log: [------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, August 30, 2007 11:18:55 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 31/08/2007 Kaspersky Anti-Virus database records: 375960 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 119807 Number of viruses found: 2 Number of infected objects: 41399 Number of suspicious objects: 0 Duration of the scan process: 03:03:32 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Documents\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.ASX Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.BMP Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.WMA Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst1.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst10.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst11.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst12.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst13.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst14.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst15.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst2.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst3.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst4.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst5.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst6.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst7.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst8.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst9.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Thumbs.db Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Me\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Me\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Me\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Me\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Me\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Me\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Me\ntuser.dat Object is locked skipped C:\Documents and Settings\Me\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Me\Shared\ Games.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\ Games.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\ Music.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\ Music.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\ Software.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\ Software.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\! Ebook - Electric Motor Controls Tutorial - pdf format.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\! Ebook - Electric Motor Controls Tutorial - pdf format.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\!! Memory Management Algorithms and Implementation in C C++ pdf.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\!! Memory Management Algorithms and Implementation in C C++ pdf.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\!! Metalworking - Handbook of Lost Wax or investment casting pdf.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\!! Metalworking - Handbook of Lost Wax or investment casting pdf.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\!! Programming - Write Great Code, Volume 2 Thinking Low Level Writing High Level - 2006 [ No Starch.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\!! Programming - Write Great Code, Volume 2 Thinking Low Level Writing High Level - 2006 [ No Starch.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\!( Big Mike & Jadakiss The Predator Is Back (2007) [ TapeDown.Com RapHustle.Com ].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\!( Big Mike & Jadakiss The Predator Is Back (2007) [ TapeDown.Com RapHustle.Com ].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\#1 DVD Ripper ver. 5.0 + crack.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\#1 DVD Ripper ver. 5.0 + crack.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\"Heroes" [S01] [E12] [HDTVRipXviDMP3].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\"Heroes" [S01] [E12] [HDTVRipXviDMP3].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\» Find tech gifts.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\» Find tech gifts.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'Brian Lara International Cricket 2007 [PAL][PS2DVD][English][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'Brian Lara International Cricket 2007 [PAL][PS2DVD][English][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'Burnout Dominator [PAL][PS2DVD][Multi][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'Burnout Dominator [PAL][PS2DVD][Multi][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'Dawn Of Mana [NTSC][PS2DVD][English][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'Dawn Of Mana [NTSC][PS2DVD][English][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'God of War 2 [NTSC][PS2DVD9][English][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'God of War 2 [NTSC][PS2DVD9][English][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'M.A.C.H. [USA][UMDFull][English][PSP][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'M.A.C.H. [USA][UMDFull][English][PSP][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'**** My Ride [PAL][PS2DVD][English][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'**** My Ride [PAL][PS2DVD][English][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'Piratas del Caribe - En el fin del mundo [PC][DVD][Multi5][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'Piratas del Caribe - En el fin del mundo [PC][DVD][Multi5][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'Pirates of the Caribbean At Worlds End [NTSC][PS2DVD][English][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'Pirates of the Caribbean At Worlds End [NTSC][PS2DVD][English][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'Rayman Raving Rabbids [PAL][PS2DVD][Ingles][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'Rayman Raving Rabbids [PAL][PS2DVD][Ingles][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'Teenage Mutant Ninja Turtles [PAL][PS2DVD][English][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'Teenage Mutant Ninja Turtles [PAL][PS2DVD][English][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'The Fast and the Furious Tokyo Drift [PAL][PS2DVD][English][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'The Fast and the Furious Tokyo Drift [PAL][PS2DVD][English][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\'UEFA Champions League 2006 - 2007 [PAL][PS2DVD][Multi][www.emwreloaded.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\'UEFA Champions League 2006 - 2007 [PAL][PS2DVD][Multi][www.emwreloaded.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\((Demonoid com))-Howard Stern 01 22 07 56k Wrap Up Show CF.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\((Demonoid com))-Howard Stern 01 22 07 56k Wrap Up Show CF.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(anfs)Detective Conan 394.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(anfs)Detective Conan 394.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(APP) Audio Software Pack.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(APP) Audio Software Pack.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Bmc) Be A Successfull Consultant - Insider Guide To Setup And Running Consulting Service pdf.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Bmc) Be A Successfull Consultant - Insider Guide To Setup And Running Consulting Service pdf.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Cucusoft) Zune Video Converter Suite 5.25.5.8.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Cucusoft) Zune Video Converter Suite 5.25.5.8.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-Howard Stern CF 5 21 07 128kbs.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-Howard Stern CF 5 21 07 128kbs.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-HOWARD STERN ON SIRIUS 1 22 2007 WrapUP Show RUN DOWN! CF MP3 Stereo No Commercials!.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-HOWARD STERN ON SIRIUS 1 22 2007 WrapUP Show RUN DOWN! CF MP3 Stereo No Commercials!.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-PSP Games List B All ISOCSO No Imports OR PSX Tested 3 03OE C 909833 0796.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-PSP Games List B All ISOCSO No Imports OR PSX Tested 3 03OE C 909833 0796.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-PSP Games List F All ISO CSO No Imports OR PSX Tested 3 03OE C 909833 0796.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Demonoid com)-PSP Games List F All ISO CSO No Imports OR PSX Tested 3 03OE C 909833 0796.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Demonoid.com) Microsoft Windows Vista RTM Build 6000 x86 (32 bit) Ultimate Edition [MSDN DVD].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Demonoid.com) Microsoft Windows Vista RTM Build 6000 x86 (32 bit) Ultimate Edition [MSDN DVD].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(eBook) The Secret Rituals of the O T O (Illuminati, Templars, Freemasons, etc) pdf.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(eBook) The Secret Rituals of the O T O (Illuminati, Templars, Freemasons, etc) pdf.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Education) Cambridge - Self-Scoring Iq Test.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Education) Cambridge - Self-Scoring Iq Test.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(ES) Supernatural S01E18 FRENCH DVTV XViD.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(ES) Supernatural S01E18 FRENCH DVTV XViD.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(IKEA 2007 Catalogue) (160 Million Copies Printed)(ebook-portal).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(IKEA 2007 Catalogue) (160 Million Copies Printed)(ebook-portal).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(LATEST VERSIONS) Clone Suite Dec 14 2006 (CloneDVD 2 9 0 3 - CloneCD 5 2 9 1 - AnyDVD 6 0 9 5 - Clo.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(LATEST VERSIONS) Clone Suite Dec 14 2006 (CloneDVD 2 9 0 3 - CloneCD 5 2 9 1 - AnyDVD 6 0 9 5 - Clo.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Marvel Comics) Earth X - Universe X - Paradise X.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Marvel Comics) Earth X - Universe X - Paradise X.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(PC Game) WarCraft III - Reign of Chaos - (Plus Serial & Crack) rar.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(PC Game) WarCraft III - Reign of Chaos - (Plus Serial & Crack) rar.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(PC GAMES) Airport Tycoon 3 zip.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(PC GAMES) Airport Tycoon 3 zip.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(PCCD)Leisure Suit Larry Magna Cum Laude Uncut and Uncensored (4 CD Roms).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(PCCD)Leisure Suit Larry Magna Cum Laude Uncut and Uncensored (4 CD Roms).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(PQ) DVD to iPod Video Suite 2.5.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(PQ) DVD to iPod Video Suite 2.5.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(PSP)Vagrant Story (PSX) By cobrabxny rar.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(PSP)Vagrant Story (PSX) By cobrabxny rar.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(PSP-EBOOT) Tenchu - Stealth Assassins NTSC-U -=Malaki Torrent=-.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(PSP-EBOOT) Tenchu - Stealth Assassins NTSC-U -=Malaki Torrent=-.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Reseed) Fatman Scoop - In The Club [Retail 2006] [Hip Hop] [www file24ever com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Reseed) Fatman Scoop - In The Club [Retail 2006] [Hip Hop] [www file24ever com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(Sybex) NET Framework Solutions - In search of the lost Win32 API pdf.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(Sybex) NET Framework Solutions - In search of the lost Win32 API pdf.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\(WORKING) Sailor Moon UNIVERSE Op-Ed.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\(WORKING) Sailor Moon UNIVERSE Op-Ed.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\++Demonoid-RICHARD P FEYNMAN SURELY YOU'RE JOKING MR FEYNMAN [format PDF] [archive RAR] 2597941 6122.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\++Demonoid-RICHARD P FEYNMAN SURELY YOU'RE JOKING MR FEYNMAN [format PDF] [archive RAR] 2597941 6122.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\+-Demonoid com-+ IMAX The Secret Of Life On Earth.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\+-Demonoid com-+ IMAX The Secret Of Life On Earth.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\- Demonoid com -PSP Games List A All ISO CSO No Imports OR PSX Tested 3 03OE C 909833 0796.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\- Demonoid com -PSP Games List A All ISO CSO No Imports OR PSX Tested 3 03OE C 909833 0796.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\- Select one -.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\- Select one -.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\-- A -- 21 thousand books by (prisoner520).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\-- A -- 21 thousand books by (prisoner520).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\07 AMA Supercross Orlando lites R11 divx.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\07 AMA Supercross Orlando lites R11 divx.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\0823 - Hotel Dusk Room 215 U zip.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\0823 - Hotel Dusk Room 215 U zip.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\1 Billion Downloads!.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\1 Billion Downloads!.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\1 Halloweentown Movies.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\1 Halloweentown Movies.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\10 DesignLoad Templates.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\10 DesignLoad Templates.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\10 out of 10 - what a babe!.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\10 out of 10 - what a babe!.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\10 Template Monster Pack 5 (Template 2135 2395) June 10 TEMPLATES.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\10 Template Monster Pack 5 (Template 2135 2395) June 10 TEMPLATES.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\100 (Yep! 100) Amazing Wallpapers (01-100) (High Quality & High Resolution) (desktop-it blogspot.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\100 (Yep! 100) Amazing Wallpapers (01-100) (High Quality & High Resolution) (desktop-it blogspot.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\100 Best Auto HQ Wallpapers ever.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\100 Best Auto HQ Wallpapers ever.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\100 High Quality Wallpapers 2560x1600 Segment rar.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\100 High Quality Wallpapers 2560x1600 Segment rar.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\1080 movie.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\1080 movie.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\11 Amazing Website Templates (79-89) (Easy To Edit, Simple & Pro) (readytemplates blogspot com).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\11 Amazing Website Templates (79-89) (Easy To Edit, Simple & Pro) (readytemplates blogspot com).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\111 Cool Hand Writing Fonts.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\111 Cool Hand Writing Fonts.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\115 Amazing & Unique Wallpapers (3D, Cars, Misc, Nature, etc ) (All Resolutions) (desktop-it blo.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\115 Amazing & Unique Wallpapers (3D, Cars, Misc, Nature, etc ) (All Resolutions) (desktop-it blo.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\12 Amazing Website Templates (79-90) (Easy To Edit, Simple & Pro) (readytemplates blogspot com).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\12 Amazing Website Templates (79-90) (Easy To Edit, Simple & Pro) (readytemplates blogspot com).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\136-www torrent to WarcraftIII-ReignofChaosgerman[AufWunsch].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\136-www torrent to WarcraftIII-ReignofChaosgerman[AufWunsch].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\13snart30 Xvid Swesub ADeadRat-JimmY.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\13snart30 Xvid Swesub ADeadRat-JimmY.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\151 themes windows xp [smartorrent.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\151 themes windows xp [smartorrent.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\175 Ways to Get More Done In Less Time { www IPTorrents com }.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\175 Ways to Get More Done In Less Time { www IPTorrents com }.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\18 Great Illusions.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\18 Great Illusions.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\18 PSP GAMES + Launchers rar d-mininova org-b.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\18 PSP GAMES + Launchers rar d-mininova org-b.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\18 Wheels of Steel Convoy.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\18 Wheels of Steel Convoy.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2 Amazing Fonts (Pulse & Gorillaz) (Fancy Fonts) (a-font blogspot com).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2 Amazing Fonts (Pulse & Gorillaz) (Fancy Fonts) (a-font blogspot com).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2 Amazing Wallpapers 94-95 (High Quality & High Resolution) (desktop-it blogspot com).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2 Amazing Wallpapers 94-95 (High Quality & High Resolution) (desktop-it blogspot com).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2 Reflexive Arcade games.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2 Reflexive Arcade games.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2005 UNIBUDS English Dhamma Talk Recordings.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2005 UNIBUDS English Dhamma Talk Recordings.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2006 01 21 AFC CHAMPiONSHiP GAME 2xDVD-TYT.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2006 01 21 AFC CHAMPiONSHiP GAME 2xDVD-TYT.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2006 dvdrip.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2006 dvdrip.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2007 calendar.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2007 calendar.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2007 dvdrip.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2007 dvdrip.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2007 WRC ARG D2.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2007 WRC ARG D2.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2007 WRC ARG D3.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2007 WRC ARG D3.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2007 WRC ITA D3.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2007 WRC ITA D3.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\20070122 Mon Alex mp3.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\20070122 Mon Alex mp3.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\21 Amazing Fonts (1-21) (Fancy, Techno, Graffiti, & Others) (a-font blogspot com).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\21 Amazing Fonts (1-21) (Fancy, Techno, Graffiti, & Others) (a-font blogspot com).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\21 Amazing Wallpapers (74-95) (High Quality & High Resolution) (desktop-it blogspot com).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\21 Amazing Wallpapers (74-95) (High Quality & High Resolution) (desktop-it blogspot com).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\21 paris Pictures rar.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\21 paris Pictures rar.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\21 thousand ebooks -- A -- look for B and C and the rest by (prisoner520).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\21 thousand ebooks -- A -- look for B and C and the rest by (prisoner520).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\223 Novels of Various Genre Types{www IPTorrents com}.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\223 Novels of Various Genre Types{www IPTorrents com}.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 - 24 S06 E02 DVDRip DivX-WeBsEcReTa.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 - 24 S06 E02 DVDRip DivX-WeBsEcReTa.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 - 24 s06e01-04 DVDRip 100MBITS SEED SmarTorrent by MsKHoT.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 - 24 s06e01-04 DVDRip 100MBITS SEED SmarTorrent by MsKHoT.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 - 24 S06E03 DVDRip XviD-MEMETiC subtitulado www seriecanal com avi.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 - 24 S06E03 DVDRip XviD-MEMETiC subtitulado www seriecanal com avi.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 720p.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 720p.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 Amazing Wallpapers (70-95) (High Quality & High Resolution) (desktop-it blogspot com).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 Amazing Wallpapers (70-95) (High Quality & High Resolution) (desktop-it blogspot com).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 ISLAMIC-E-BOOKS (Duas & Duroods ).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 ISLAMIC-E-BOOKS (Duas & Duroods ).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 s06.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 s06.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E01 6AM TO 7AM PROPER DVDRip XviD-MEMETiC [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E01 6AM TO 7AM PROPER DVDRip XviD-MEMETiC [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E01-04 and 12mins of E05.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E01-04 and 12mins of E05.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E02 7AM TO 8AM DVDRip XviD-MEMETiC [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E02 7AM TO 8AM DVDRip XviD-MEMETiC [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E03 8AM TO 9AM DVDRip XviD-MEMETiC [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E03 8AM TO 9AM DVDRip XviD-MEMETiC [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E03 DVDRIP ASIA-TEAM.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E03 DVDRIP ASIA-TEAM.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E04 DVDRIP ASIA-TEAM.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E04 DVDRIP ASIA-TEAM.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E04 WS DVDRiP XviD-AERiAL [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E04 WS DVDRiP XviD-AERiAL [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E04 WS DVDRiP XviD-AERiAL.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E04 WS DVDRiP XviD-AERiAL.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E05 1000AM-1100AM HDTV XviD-FQM [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E05 1000AM-1100AM HDTV XviD-FQM [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E05 720p HDTV X264-DIMENSION [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E05 720p HDTV X264-DIMENSION [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E05 HR HDTV XviD-CTU [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E05 HR HDTV XviD-CTU [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E14 720p HDTV x264-SAiNTS [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E14 720p HDTV x264-SAiNTS [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E14 HDTV XviD-LOL [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E14 HDTV XviD-LOL [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E14 HR HDTV XviD-CRiMSON [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E14 HR HDTV XviD-CRiMSON [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E22 HDTV XviD-NoTV [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E22 HDTV XviD-NoTV [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E22 HR HDTV XviD-CTU [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E22 HR HDTV XviD-CTU [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E23 720p HDTV x264-CTU [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E23 720p HDTV x264-CTU [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E23 HR HDTV XviD-NBS [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E23 HR HDTV XviD-NBS [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 s06e23.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 s06e23.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E24 720p HDTV x264-CTU [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E24 720p HDTV x264-CTU [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E24 HDTV XviD-LOL [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E24 HDTV XviD-LOL [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24 S06E24 HR HDTV XviD-NBS [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24 S06E24 HR HDTV XviD-NBS [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24-6x00 Season 6 Prequel.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24-6x00 Season 6 Prequel.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\24.S06E14.HDTV.XviD-LOL - (torrential.kicks-***.org).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\24.S06E14.HDTV.XviD-LOL - (torrential.kicks-***.org).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\259 ANIMATED AVATARS.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\259 ANIMATED AVATARS.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Days Later (DVD-Rip Divx) - [www slotorrent net].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Days Later (DVD-Rip Divx) - [www slotorrent net].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Mac OS X Books (10 4 Tiger mostly){www IPTorrents com}.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Mac OS X Books (10 4 Tiger mostly){www IPTorrents com}.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 weeks later (2007) cam divx-CANALSTREET.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 weeks later (2007) cam divx-CANALSTREET.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 weeks later cam Msrg release Mini Mark.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 weeks later cam Msrg release Mini Mark.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later INTERNAL TS XviD-CAMERA [ www torrentat org ].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later INTERNAL TS XviD-CAMERA [ www torrentat org ].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later READ NFO TS SVCD-RUSTLERS.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later READ NFO TS SVCD-RUSTLERS.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later TeleSync XVid KVCD.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later TeleSync XVid KVCD.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later TS XViD-FuZe ToxicTorrents com.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later TS XViD-FuZe ToxicTorrents com.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later TS XViD-FuZe [www torrentfive com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later TS XViD-FuZe [www torrentfive com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later Wallpapers - Maglor1212.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later Wallpapers - Maglor1212.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later [2007]CAMRIP[ENG]-mEsiah za one.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later [2007]CAMRIP[ENG]-mEsiah za one.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 weeks later.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 weeks later.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\28 Weeks Later[www.pirateuropa.com].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\28 Weeks Later[www.pirateuropa.com].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2GB5000 1680x1050 wallpapers & changer.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2GB5000 1680x1050 wallpapers & changer.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\2Pac-Pac's Life-(EXPLICIT RETAIL)-2006-h8m3.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\2Pac-Pac's Life-(EXPLICIT RETAIL)-2006-h8m3.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3 03OE-A + tuto french rar.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3 03OE-A + tuto french rar.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3 Inches Of Blood 2007 Fire Up The Blades V0.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3 Inches Of Blood 2007 Fire Up The Blades V0.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3 Inches Of Blood - Fire Up The Blades (2007).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3 Inches Of Blood - Fire Up The Blades (2007).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3 Lbs S01E02 HDTV XviD-LOL [eztv].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3 Lbs S01E02 HDTV XviD-LOL [eztv].zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3-D Backgrounds.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3-D Backgrounds.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3-D design pictures - part 1 - maglor1212.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3-D design pictures - part 1 - maglor1212.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3-D design pictures - part 2 - maglor1212.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3-D design pictures - part 2 - maglor1212.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3-D design pictures - part 3 - maglor1212.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3-D design pictures - part 3 - maglor1212.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\3-D Wallpapers - Maglor1212.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\3-D Wallpapers - Maglor1212.zip ZIP: infected - 1 skipped ....................... ....................... ....................... C:\Documents and Settings\Me\Shared\[ZA] Death Note - 13 (HQ & Karaoke).zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[ZA] Death Note - 13 (HQ & Karaoke).zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[ZA]Death Note 13 [english] version 2.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[ZA]Death Note 13 [english] version 2.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[Zettai] Digimon Adventures 02 Ending 2 [C9A2640E] mp4.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[Zettai] Digimon Adventures 02 Ending 2 [C9A2640E] mp4.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[ZMPIG][DEATH NOTE][32][RV10 aac][jap chn] rmvb.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[ZMPIG][DEATH NOTE][32][RV10 aac][jap chn] rmvb.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[ZMPIG][kekkaishi][23][Jp Cn][Xvid BF] rmvb.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[ZMPIG][kekkaishi][23][Jp Cn][Xvid BF] rmvb.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[ZMPIG][naruto][223][Jp Cn][Xvid BF] rmvb.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[ZMPIG][naruto][223][Jp Cn][Xvid BF] rmvb.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[ZMPIG][naruto][234][Jp Cn][Xvid BF] rmvb.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[ZMPIG][naruto][234][Jp Cn][Xvid BF] rmvb.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[]Demonoid com[]-Windows Vista 32Bit Retail OEM Basic to Ultimate 4479177 3616.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[]Demonoid com[]-Windows Vista 32Bit Retail OEM Basic to Ultimate 4479177 3616.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\[~NankH~ & Star Hill] Saint Seiya next dimension - the myth of Hades - part 4.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\[~NankH~ & Star Hill] Saint Seiya next dimension - the myth of Hades - part 4.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\{Beatles Tribute Band} The Blackbirds Live On Stage Film {PART 2 OF 2} Megaluf Sept 2005 {ZORBY}wm.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\{Beatles Tribute Band} The Blackbirds Live On Stage Film {PART 2 OF 2} Megaluf Sept 2005 {ZORBY}wm.zip ZIP: infected - 1 skipped C:\Documents and Settings\Me\Shared\~Caine+ANONYMOUS Walls [MISC Anime & General from 4chan org].zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Documents and Settings\Me\Shared\~Caine+ANONYMOUS Walls [MISC Anime & General from 4chan org].zip ZIP: infected - 1 skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\onoes.exe Infected: Backdoor.Win32.EggDrop.v skipped C:\Program Files\outlook\p.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Program Files\outlook\p.zip ZIP: infected - 1 skipped C:\Program Files\outlook\v.tmp Infected: P2P-Worm.Win32.VB.dw skipped C:\RECYCLER\NPROTECT\00006795.inf Object is locked skipped C:\RECYCLER\NPROTECT\00006799.edb Object is locked skipped C:\RECYCLER\NPROTECT\00006800.log Object is locked skipped C:\RECYCLER\NPROTECT\00006803.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006804.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006805.ini Object is locked skipped C:\RECYCLER\NPROTECT\00006807.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006821.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006824.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006826.dat Object is locked skipped C:\RECYCLER\NPROTECT\00006828.hlp Object is locked skipped C:\RECYCLER\NPROTECT\00006829.cnt Object is locked skipped C:\RECYCLER\NPROTECT\00006830.ini Object is locked skipped C:\RECYCLER\NPROTECT\00006831.ini Object is locked skipped C:\RECYCLER\NPROTECT\00006832.txt Object is locked skipped C:\RECYCLER\NPROTECT\00006833.exe Object is locked skipped C:\RECYCLER\NPROTECT\00006834.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006835.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00006836.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006837.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006838.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006839.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006840.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006841.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006842.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006843.htm Object is locked skipped C:\RECYCLER\NPROTECT\00006844.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006845.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006846.css Object is locked skipped C:\RECYCLER\NPROTECT\00006847.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006848.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006849.gif Object is locked skipped C:\RECYCLER\NPROTECT\00006850.gif Object is locked skipped C:\RECYCLER\NPROTECT\00006851.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006852.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006853.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006854.gif Object is locked skipped C:\RECYCLER\NPROTECT\00006855.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006856.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006857.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006858.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006859.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006860.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006861.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006862.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006863.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006864.log Object is locked skipped C:\RECYCLER\NPROTECT\00006865.exe Object is locked skipped C:\RECYCLER\NPROTECT\00006867.CAB Object is locked skipped C:\RECYCLER\NPROTECT\00006868.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006870.cab Object is locked skipped C:\RECYCLER\NPROTECT\00006871.CAB Object is locked skipped C:\RECYCLER\NPROTECT\00006872.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006873.dat Object is locked skipped C:\RECYCLER\NPROTECT\00006882.edb Object is locked skipped C:\RECYCLER\NPROTECT\00006886.185 Object is locked skipped C:\RECYCLER\NPROTECT\00006887.187 Object is locked skipped C:\RECYCLER\NPROTECT\00006893.edb Object is locked skipped C:\RECYCLER\NPROTECT\00006927.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006928.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006929.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006933.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006934.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006935.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006939.bkp Object is locked skipped C:\RECYCLER\NPROTECT\00006940.dat Object is locked skipped C:\RECYCLER\NPROTECT\00006941.dll Object is locked skipped C:\RECYCLER\NPROTECT\00006942.CNF Object is locked skipped C:\RECYCLER\NPROTECT\00006957.386 Object is locked skipped C:\RECYCLER\NPROTECT\00006958.386 Object is locked skipped C:\RECYCLER\NPROTECT\00006966.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00006967.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00006968.INF Object is locked skipped C:\RECYCLER\NPROTECT\00006969.CAT Object is locked skipped C:\RECYCLER\NPROTECT\00006972.ca^ Object is locked skipped C:\RECYCLER\NPROTECT\00006973.in^ Object is locked skipped C:\RECYCLER\NPROTECT\00006974.sy^ Object is locked skipped C:\RECYCLER\NPROTECT\00006975.ca^ Object is locked skipped C:\RECYCLER\NPROTECT\00006976.in^ Object is locked skipped C:\RECYCLER\NPROTECT\00006977.sy^ Object is locked skipped C:\RECYCLER\NPROTECT\00006978.dl^ Object is locked skipped C:\RECYCLER\NPROTECT\00006979.dl^ Object is locked skipped C:\RECYCLER\NPROTECT\00006980.dl^ Object is locked skipped C:\RECYCLER\NPROTECT\00006990.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006995.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006997.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007016.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007047.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007052.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007053.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007054.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007055.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007056.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007057.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007058.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007059.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007060.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007061.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007062.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007063.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007064.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007065.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007066.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007067.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007068.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007069.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007070.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007071.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007072.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007076.THE Object is locked skipped C:\RECYCLER\NPROTECT\00007078.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007079.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007080.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007097.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007100.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007101.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007103.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007104.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007105.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007106.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007107.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007110.BIN Object is locked skipped C:\RECYCLER\NPROTECT\00007116.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007120.000 Object is locked skipped C:\RECYCLER\NPROTECT\00007123.PNF Object is locked skipped C:\RECYCLER\NPROTECT\00007124.bin Object is locked skipped C:\RECYCLER\NPROTECT\00007125.hdr Object is locked skipped C:\RECYCLER\NPROTECT\00007126.cab Object is locked skipped C:\RECYCLER\NPROTECT\00007127.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007128.inx Object is locked skipped C:\RECYCLER\NPROTECT\00007129.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007130.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007131.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007132.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007137.PNF Object is locked skipped C:\RECYCLER\NPROTECT\00007138.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007140.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007141.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007142.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007143.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007152.PNF Object is locked skipped C:\RECYCLER\NPROTECT\00007153.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007154.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007155.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007156.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007157.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007166.txt Object is locked skipped C:\RECYCLER\NPROTECT\00007172.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007177.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007178.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007179.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007180.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007182.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007183.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007184.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007189.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007196.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007197.URL Object is locked skipped C:\RECYCLER\NPROTECT\00007198.HLP Object is locked skipped C:\RECYCLER\NPROTECT\00007199.HLP Object is locked skipped C:\RECYCLER\NPROTECT\00007200.HLP Object is locked skipped C:\RECYCLER\NPROTECT\00007201.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00007202.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00007203.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00007204.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007205.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007206.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007207.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007208.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007209.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007210.TXT Object is locked skipped C:\RECYCLER\NPROTECT\00007211.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007212.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007213.DO_ Object is locked skipped C:\RECYCLER\NPROTECT\00007214.SY_ Object is locked skipped C:\RECYCLER\NPROTECT\00007215.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007216.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007217.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007218.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007219.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007220.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007221.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007222.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007223.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007224.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007225.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007226.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007227.inf Object is locked skipped C:\RECYCLER\NPROTECT\00007228 Object is locked skipped C:\RECYCLER\NPROTECT\00007229.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007230.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007231.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007232.vx_ Object is locked skipped C:\RECYCLER\NPROTECT\00007233.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007234.vx_ Object is locked skipped C:\RECYCLER\NPROTECT\00007235.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007236.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007237.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007238.SY_ Object is locked skipped C:\RECYCLER\NPROTECT\00007239.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007240.SY_ Object is locked skipped C:\RECYCLER\NPROTECT\00007241.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007242.cnt Object is locked skipped C:\RECYCLER\NPROTECT\00007243.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007244.hl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007245.URL Object is locked skipped C:\RECYCLER\NPROTECT\00007246.txt Object is locked skipped C:\RECYCLER\NPROTECT\00007247.cnt Object is locked skipped C:\RECYCLER\NPROTECT\00007248.dl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007249.hl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007250.dl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007251.hl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007252.inf Object is locked skipped C:\RECYCLER\NPROTECT\00007253.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007254.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007255.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007256.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007257.CAT Object is locked skipped C:\RECYCLER\NPROTECT\00007258.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007259.cat Object is locked skipped C:\RECYCLER\NPROTECT\00007260.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007261.INI Object is locked skipped C:\RECYCLER\NPROTECT\00007262.txt Object is locked skipped C:\RECYCLER\NPROTECT\00007263.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007271.000 Object is locked skipped C:\RECYCLER\NPROTECT\00007273.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007276.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007277.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007279.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007280.HDR Object is locked skipped C:\RECYCLER\NPROTECT\00007281.inx Object is locked skipped C:\RECYCLER\NPROTECT\00007282.ini Object is locked skipped C:\RECYCLER\NPROTECT\00007283.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007284.cab Object is locked skipped C:\RECYCLER\NPROTECT\00007285.hdr Object is locked skipped C:\RECYCLER\NPROTECT\00007286.bin Object is locked skipped C:\RECYCLER\NPROTECT\00007287.000 Object is locked skipped C:\RECYCLER\NPROTECT\00007289.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007290.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007291.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007292.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007293.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007294.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007295.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007296.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007309.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007310.cat Object is locked skipped C:\RECYCLER\NPROTECT\00007311.inf Object is locked skipped C:\RECYCLER\NPROTECT\00007312.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007314.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007315.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007316.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007317.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007318.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007319.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007320.rtf Object is locked skipped C:\RECYCLER\NPROTECT\00007321.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007322.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007323.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007324.ini Object is locked skipped C:\RECYCLER\NPROTECT\00007325.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007326.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007327.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007328.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007329.ini Object is locked skipped C:\RECYCLER\NPROTECT\00007339.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007342.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007344.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007371.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007372.log Object is locked skipped C:\RECYCLER\NPROTECT\NPROTECT.LOG Object is locked skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP313\A0194677.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP337\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
09-02-2007, 08:59 PM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,514
OS: 2000 Pro; XP Pro; XP Home
|
Re: Worm virus Problem
Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- You don't appear to have an active Anti-Virus program. We need to take care of that during the course of this fix. Connecting to the Internet without antivirus protection is a "Welcome" doormat for malware. It can take as little as eight seconds to infect an unprotected computer. Looks like the entire contents of that folder, C:\Documents and Settings\Me\Shared, should go.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 09-02-2007 at 09:00 PM. |
|
|
|
|
09-03-2007, 03:01 PM
|
#3 (permalink) |
|
Registered User
Join Date: Oct 2005
Posts: 70
OS: xp
|
Re: Worm virus Problem
Ok, great!
Documents and settings/me/shared is all emptied out. Here's the logfile from combo fix: [ComboFix 07-09-04.4 - "Me" 2007-09-03 17:04:33.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.177 [GMT -4:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\onoes.exe C:\WINDOWS\b.exe ((((((((((((((((((((((((( Files Created from 2007-08-04 to 2007-09-04 ))))))))))))))))))))))))))))))) 2007-09-03 17:03 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-08-30 23:01 1,308,216 --a------ C:\Program Files\HiJackThis_v2.exe 2007-08-30 19:42 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab 2007-08-30 19:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab 2007-08-30 18:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2007-08-30 18:51 5,037,072 --a------ C:\Program Files\spybotsd14.exe 2007-08-09 14:19 <DIR> d-------- C:\WINDOWS\.jagex_cache_32 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-30 23:22 5432 --a------ C:\Program Files\hijackthis.log 2002-12-05 22:28 207759 --a--c--- C:\Program Files\INSTALL.LOG ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-08-15 12:38] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-08-15 12:37] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-06-24 18:32] "AT&T DSL Service PCA Program"="C:\Program Files\AT&T\DSL\programs\dslpca.exe" [2003-09-23 14:57] "EPSON Stylus C84 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 03:00] "EPSON Stylus C84 Series (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 03:00] "wltray.exe"="C:\WINDOWS\system32\wltray.exe" [2005-03-10 15:14] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\ DESKTOP.INI [2002-09-02 21:00:00] C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\Startup\ DESKTOP.INI [2002-09-02 21:00:00] C:\DOCUME~1\Me\STARTM~1\Programs\Startup\ DESKTOP.INI [2002-09-02 21:00:00] C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\STARTM~1\Programs\Startup\ DESKTOP.INI [2002-09-02 21:00:00] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -noauth [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /installquiet [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\O2USB] o2usb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winsock2 driver] EXPLORER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet R0 OzCrd2k;OzCrd2k;C:\WINDOWS\system32\drivers\OzCrd2k.sys R1 cdudf_XP;cdudf_XP;C:\WINDOWS\system32\drivers\cdudf_XP.sys R1 pwd_2K;pwd_2K;C:\WINDOWS\system32\drivers\pwd_2K.sys R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys R3 Eplpdx02;Eplpdx02;\??\C:\WINDOWS\system32\Drivers\EPLPDX02.SYS S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys S3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys *Newly Created Service* - CATCHME Contents of the 'Scheduled Tasks' folder 2002-12-11 01:59:58 C:\WINDOWS\Tasks\ISP signup reminder 1.job - C:\WINDOWS\System32\OOBE\OOBEBALN.EXE ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-04 17:09:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = ?????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-09-04 17:10:26 C:\ComboFix-quarantined-files.txt ... 2007-09-04 17:10 --- E O F --- ] Here's the Hijackthis log: [Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 5:15:29 PM, on 9/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\AT&T\DSL\programs\dslpca.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE C:\WINDOWS\system32\wltray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HiJackThis_v2.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AT&T DSL Service PCA Program] C:\Program Files\AT&T\DSL\programs\dslpca.exe /ws O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [EPSON Stylus C84 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P32 "EPSON Stylus C84 Series (Copy 1)" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186528708672 O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 5279 bytes ] |
|
|
|
|
09-03-2007, 05:05 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,514
OS: 2000 Pro; XP Pro; XP Home
|
Re: Worm virus Problem
You are using an outdated version of Hijack This. Please delete your current version.
Next, download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. --------------------------------------------------------------------------------------------- Please post a new log with the updated version. --------------------------------------------------------------------------------------------- Create an uninstall list: With HiJackThis still open
---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-03-2007, 10:44 PM
|
#5 (permalink) |
|
Registered User
Join Date: Oct 2005
Posts: 70
OS: xp
|
Re: Worm virus Problem
Ok here's the log file for startup:
[Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:58:30 AM, on 9/5/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\AT&T\DSL\programs\dslpca.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE C:\WINDOWS\system32\wltray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AT&T DSL Service PCA Program] C:\Program Files\AT&T\DSL\programs\dslpca.exe /ws O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [EPSON Stylus C84 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P32 "EPSON Stylus C84 Series (Copy 1)" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186528708672 O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 4989 bytes ] here's the uninstall list: [AC97 SoftV92 Data Fax Modem Actiontec MD56ORD V92 MDC Modem Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Flash Player ActiveX Adobe Shockwave Player AT&T DSL Service for AT&T Worldnet Belkin Wireless Utility Britannica Ready Reference CEP - Color Enable Package Dell Modem-On-Hold Dell Picture Studio - Dell Image Expert Dell Solution Center Dell Support Digital Line Detect DirectX Media Runtime 5.1 Diskeeper Professional Edition Easy CD Creator 5 Platinum EPSON EPIC C84 EPSON Printer Software Fish Tycoon HighMAT Extension to Microsoft Windows XP CD Writing Wizard HijackThis 2.0.2 Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) InterActual Player InterVideo WinDVD ItsDeductible Express J2SE Runtime Environment 5.0 Update 1 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 3 J2SE Runtime Environment 5.0 Update 6 Java(TM) 6 Update 2 Java(TM) SE Runtime Environment 6 Update 1 Kaspersky Online Scanner LiveReg (Symantec Corporation) Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.0 Hotfix (KB928367) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Age of Empires II Microsoft Data Access Components KB870669 Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office XP Professional Microsoft Windows Journal Viewer Modem Helper MSN Messenger 6.2 MUSICMATCH® Jukebox NVIDIA Windows 2000/XP Display Drivers O2UsbCrd OTOY Paint Shop Pro 7 Anniversary Edition Puzzle Pirates Quicken 2002 New User Edition QuickTime Q-Xpress Installer 1.1.9 RealPlayer Basic Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Shockwave Sierra Utilities SigmaTel AC97 Audio Drivers Spybot - Search & Destroy 1.4 Synaptics Pointing Device Driver The Sims 2 The Sims 2 Open For Business The Sims 2 University The Sims File Cop The Sims Unleashed TurboTax Basic 2004 Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB936357) Viewpoint Media Player (Remove Only) WexTech AnswerWorks Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows XP Hotfix - KB834707 Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinGate Internet Client WinZip WordPerfect Office 2002 WordPerfect Office 2002 Yahoo! Messenger ] |
|
|
|
|
09-03-2007, 10:50 PM
|
#6 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,514
OS: 2000 Pro; XP Pro; XP Home
|
Re: Worm virus Problem
Thanks. Let's get some protection on your system.
Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: J2SE Runtime Environment 5.0 Update 1 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 3 J2SE Runtime Environment 5.0 Update 6 Java(TM) SE Runtime Environment 6 Update 1 These are all outdated, and security risks by having them installed still. Unfortunately, Java does not uninstall previous version when you update, nor tell you that you should. Leave Java(TM) 6 Update 2 alone, as it is the most recent. --------------------------------------------------------------------------------------------- I see no evidence of an AntiVirus program on your system. This must be resolved. Here are a few very good free Antivirus products which are available:Select one of these, or another of your choice. Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out. Install, update definitions, run a full system scan. Once that's done, please post a new HijackThis log.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-15-2007, 07:12 AM
|
#7 (permalink) |
|
Registered User
Join Date: Oct 2005
Posts: 70
OS: xp
|
Re: Worm virus Problem
Hi,
Ok, I can't seem to copy/paste from the avast scan results :( I am gonna type it out for you. I moved them all to the chest since I couldn't repair them. [C:\Program files\outlook\v.tmp|Infection Win32:VB-IE [Wrm]. File was succesfully moved to chest. C:qoobox\Quarantine\C\onoes.exe.vir|Infection:Win32:SdBot-gen44 [trj]. File was succesfully moved to chest. C:\System Volume information\...\A0239287.cf|Infecttion:Win32Dadobra-EY[Trj].File was succesfully moved to chest. C:\System Volume Information\...\A0239302.exe|Infection:Sdbot-gen44[Trj].File was succesfully moved to chest.] hijack this: [Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:23:29 AM, on 9/16/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\AT&T\DSL\programs\dslpca.exe C:\WINDOWS\system32\wltray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashChest.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AT&T DSL Service PCA Program] C:\Program Files\AT&T\DSL\programs\dslpca.exe /ws O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [EPSON Stylus C84 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P32 "EPSON Stylus C84 Series (Copy 1)" /O6 "USB001" /M "Stylus C84" O4 - HKLM\..\Run: [wltray.exe] C:\WINDOWS\system32\wltray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1186528708672 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 5609 bytes ] |
|
|
|
|
09-15-2007, 08:54 AM
|
#8 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,514
OS: 2000 Pro; XP Pro; XP Home
|
Re: Worm virus Problem
That looks good.
Run a new scan with Kaspersky to see if anything is left. This time, use the extended scan settings, as indicated in the instructions below. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-17-2007, 01:24 PM
|
#9 (permalink) |
|
Registered User
Join Date: Oct 2005
Posts: 70
OS: xp
|
Re: Worm virus Problem
Here's the new Kaspersky scan results:
[------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Tuesday, September 18, 2007 3:15:23 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 17/09/2007 Kaspersky Anti-Virus database records: 419952 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 104235 Number of viruses found: 1 Number of infected objects: 2 Number of suspicious objects: 0 Duration of the scan process: 01:46:02 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Documents\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.ASX Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.BMP Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\MUSIC.WMA Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst1.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst10.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst11.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst12.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst13.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst14.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst15.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst2.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst3.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst4.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst5.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst6.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst7.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst8.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0068E3BC\Plylst9.wpl Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\DESKTOP.INI Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Thumbs.db Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg Object is locked skipped C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Me\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Me\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Me\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Me\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Me\Local Settings\History\History.IE5\MSHist012007091820070919\index.dat Object is locked skipped C:\Documents and Settings\Me\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Me\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Me\ntuser.dat Object is locked skipped C:\Documents and Settings\Me\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped C:\Program Files\outlook\p.zip/Setup.exe Infected: P2P-Worm.Win32.VB.dw skipped C:\Program Files\outlook\p.zip ZIP: infected - 1 skipped C:\RECYCLER\NPROTECT\00006795.inf Object is locked skipped C:\RECYCLER\NPROTECT\00006799.edb Object is locked skipped C:\RECYCLER\NPROTECT\00006800.log Object is locked skipped C:\RECYCLER\NPROTECT\00006803.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006804.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006805.ini Object is locked skipped C:\RECYCLER\NPROTECT\00006807.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006821.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006824.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006826.dat Object is locked skipped C:\RECYCLER\NPROTECT\00006828.hlp Object is locked skipped C:\RECYCLER\NPROTECT\00006829.cnt Object is locked skipped C:\RECYCLER\NPROTECT\00006830.ini Object is locked skipped C:\RECYCLER\NPROTECT\00006831.ini Object is locked skipped C:\RECYCLER\NPROTECT\00006832.txt Object is locked skipped C:\RECYCLER\NPROTECT\00006833.exe Object is locked skipped C:\RECYCLER\NPROTECT\00006834.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006835.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00006836.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006837.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006838.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006839.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006840.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006841.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006842.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006843.htm Object is locked skipped C:\RECYCLER\NPROTECT\00006844.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006845.HTM Object is locked skipped C:\RECYCLER\NPROTECT\00006846.css Object is locked skipped C:\RECYCLER\NPROTECT\00006847.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006848.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006849.gif Object is locked skipped C:\RECYCLER\NPROTECT\00006850.gif Object is locked skipped C:\RECYCLER\NPROTECT\00006851.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006852.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006853.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006854.gif Object is locked skipped C:\RECYCLER\NPROTECT\00006855.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006856.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006857.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006858.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006859.BMP Object is locked skipped C:\RECYCLER\NPROTECT\00006860.GIF Object is locked skipped C:\RECYCLER\NPROTECT\00006861.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006862.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006863.LNK Object is locked skipped C:\RECYCLER\NPROTECT\00006864.log Object is locked skipped C:\RECYCLER\NPROTECT\00006865.exe Object is locked skipped C:\RECYCLER\NPROTECT\00006867.CAB Object is locked skipped C:\RECYCLER\NPROTECT\00006868.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006870.cab Object is locked skipped C:\RECYCLER\NPROTECT\00006871.CAB Object is locked skipped C:\RECYCLER\NPROTECT\00006872.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006873.dat Object is locked skipped C:\RECYCLER\NPROTECT\00006882.edb Object is locked skipped C:\RECYCLER\NPROTECT\00006886.185 Object is locked skipped C:\RECYCLER\NPROTECT\00006887.187 Object is locked skipped C:\RECYCLER\NPROTECT\00006893.edb Object is locked skipped C:\RECYCLER\NPROTECT\00006927.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006928.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006929.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006933.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006934.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006935.USE Object is locked skipped C:\RECYCLER\NPROTECT\00006939.bkp Object is locked skipped C:\RECYCLER\NPROTECT\00006940.dat Object is locked skipped C:\RECYCLER\NPROTECT\00006941.dll Object is locked skipped C:\RECYCLER\NPROTECT\00006942.CNF Object is locked skipped C:\RECYCLER\NPROTECT\00006957.386 Object is locked skipped C:\RECYCLER\NPROTECT\00006958.386 Object is locked skipped C:\RECYCLER\NPROTECT\00006966.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00006967.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00006968.INF Object is locked skipped C:\RECYCLER\NPROTECT\00006969.CAT Object is locked skipped C:\RECYCLER\NPROTECT\00006972.ca^ Object is locked skipped C:\RECYCLER\NPROTECT\00006973.in^ Object is locked skipped C:\RECYCLER\NPROTECT\00006974.sy^ Object is locked skipped C:\RECYCLER\NPROTECT\00006975.ca^ Object is locked skipped C:\RECYCLER\NPROTECT\00006976.in^ Object is locked skipped C:\RECYCLER\NPROTECT\00006977.sy^ Object is locked skipped C:\RECYCLER\NPROTECT\00006978.dl^ Object is locked skipped C:\RECYCLER\NPROTECT\00006979.dl^ Object is locked skipped C:\RECYCLER\NPROTECT\00006980.dl^ Object is locked skipped C:\RECYCLER\NPROTECT\00006990.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006995.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00006997.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007016.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007047.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007052.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007053.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007054.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007055.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007056.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007057.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007058.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007059.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007060.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007061.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007062.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007063.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007064.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007065.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007066.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007067.REG Object is locked skipped C:\RECYCLER\NPROTECT\00007068.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007069.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007070.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007071.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007072.sud Object is locked skipped C:\RECYCLER\NPROTECT\00007076.THE Object is locked skipped C:\RECYCLER\NPROTECT\00007078.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007079.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007080.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007097.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007100.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007101.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007103.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007104.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007105.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007106.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007107.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007110.BIN Object is locked skipped C:\RECYCLER\NPROTECT\00007116.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007120.000 Object is locked skipped C:\RECYCLER\NPROTECT\00007123.PNF Object is locked skipped C:\RECYCLER\NPROTECT\00007124.bin Object is locked skipped C:\RECYCLER\NPROTECT\00007125.hdr Object is locked skipped C:\RECYCLER\NPROTECT\00007126.cab Object is locked skipped C:\RECYCLER\NPROTECT\00007127.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007128.inx Object is locked skipped C:\RECYCLER\NPROTECT\00007129.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007130.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007131.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007132.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007137.PNF Object is locked skipped C:\RECYCLER\NPROTECT\00007138.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007140.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007141.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007142.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007143.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007152.PNF Object is locked skipped C:\RECYCLER\NPROTECT\00007153.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007154.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007155.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007156.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007157.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007166.txt Object is locked skipped C:\RECYCLER\NPROTECT\00007172.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007177.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007178.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007179.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007180.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007182.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007183.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007184.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007189.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007196.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007197.URL Object is locked skipped C:\RECYCLER\NPROTECT\00007198.HLP Object is locked skipped C:\RECYCLER\NPROTECT\00007199.HLP Object is locked skipped C:\RECYCLER\NPROTECT\00007200.HLP Object is locked skipped C:\RECYCLER\NPROTECT\00007201.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00007202.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00007203.DLL Object is locked skipped C:\RECYCLER\NPROTECT\00007204.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007205.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007206.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007207.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007208.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007209.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007210.TXT Object is locked skipped C:\RECYCLER\NPROTECT\00007211.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007212.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007213.DO_ Object is locked skipped C:\RECYCLER\NPROTECT\00007214.SY_ Object is locked skipped C:\RECYCLER\NPROTECT\00007215.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007216.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007217.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007218.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007219.sy_ Object is locked skipped C:\RECYCLER\NPROTECT\00007220.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007221.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007222.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007223.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007224.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007225.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007226.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007227.inf Object is locked skipped C:\RECYCLER\NPROTECT\00007228 Object is locked skipped C:\RECYCLER\NPROTECT\00007229.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007230.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007231.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007232.vx_ Object is locked skipped C:\RECYCLER\NPROTECT\00007233.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007234.vx_ Object is locked skipped C:\RECYCLER\NPROTECT\00007235.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007236.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007237.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007238.SY_ Object is locked skipped C:\RECYCLER\NPROTECT\00007239.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007240.SY_ Object is locked skipped C:\RECYCLER\NPROTECT\00007241.DL_ Object is locked skipped C:\RECYCLER\NPROTECT\00007242.cnt Object is locked skipped C:\RECYCLER\NPROTECT\00007243.ex_ Object is locked skipped C:\RECYCLER\NPROTECT\00007244.hl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007245.URL Object is locked skipped C:\RECYCLER\NPROTECT\00007246.txt Object is locked skipped C:\RECYCLER\NPROTECT\00007247.cnt Object is locked skipped C:\RECYCLER\NPROTECT\00007248.dl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007249.hl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007250.dl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007251.hl_ Object is locked skipped C:\RECYCLER\NPROTECT\00007252.inf Object is locked skipped C:\RECYCLER\NPROTECT\00007253.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007254.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007255.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007256.EXE Object is locked skipped C:\RECYCLER\NPROTECT\00007257.CAT Object is locked skipped C:\RECYCLER\NPROTECT\00007258.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007259.cat Object is locked skipped C:\RECYCLER\NPROTECT\00007260.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007261.INI Object is locked skipped C:\RECYCLER\NPROTECT\00007262.txt Object is locked skipped C:\RECYCLER\NPROTECT\00007263.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007271.000 Object is locked skipped C:\RECYCLER\NPROTECT\00007273.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007276.INF Object is locked skipped C:\RECYCLER\NPROTECT\00007277.SYS Object is locked skipped C:\RECYCLER\NPROTECT\00007279.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007280.HDR Object is locked skipped C:\RECYCLER\NPROTECT\00007281.inx Object is locked skipped C:\RECYCLER\NPROTECT\00007282.ini Object is locked skipped C:\RECYCLER\NPROTECT\00007283.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007284.cab Object is locked skipped C:\RECYCLER\NPROTECT\00007285.hdr Object is locked skipped C:\RECYCLER\NPROTECT\00007286.bin Object is locked skipped C:\RECYCLER\NPROTECT\00007287.000 Object is locked skipped C:\RECYCLER\NPROTECT\00007289.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007290.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007291.ax Object is locked skipped C:\RECYCLER\NPROTECT\00007292.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007293.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007294.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007295.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007296.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007309.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007310.cat Object is locked skipped C:\RECYCLER\NPROTECT\00007311.inf Object is locked skipped C:\RECYCLER\NPROTECT\00007312.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007314.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007315.sys Object is locked skipped C:\RECYCLER\NPROTECT\00007316.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007317.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007318.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007319.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007320.rtf Object is locked skipped C:\RECYCLER\NPROTECT\00007321.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007322.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007323.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007324.ini Object is locked skipped C:\RECYCLER\NPROTECT\00007325.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007326.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007327.exe Object is locked skipped C:\RECYCLER\NPROTECT\00007328.dll Object is locked skipped C:\RECYCLER\NPROTECT\00007329.ini Object is locked skipped C:\RECYCLER\NPROTECT\00007339.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007342.DAT Object is locked skipped C:\RECYCLER\NPROTECT\00007344.dat Object is locked skipped C:\RECYCLER\NPROTECT\00007371.edb Object is locked skipped C:\RECYCLER\NPROTECT\00007372.log Object is locked skipped C:\RECYCLER\NPROTECT\NPROTECT.LOG Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Antivirus.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\temp\Perflib_Perfdata_434.dat Object is locked skipped C:\WINDOWS\temp\_avast4_\Webshlock.txt Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. ] |
|
|
|
|
09-17-2007, 05:15 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,514
OS: 2000 Pro; XP Pro; XP Home
|
Re: Worm virus Problem
Delete this folder:
C:\Program Files\outlook NOTE: This is not the legit folder, Outlook Express. Let me know if there's any trouble with deleting that folder. Other than that, your logs appear clean.You should be good to go. We still have a few items to address. C:\Qoobox is ComboFix quarantine folder. You can safely delete it. Also delete Combofix.exe C:\System Volume Information\ is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be resetting/clearing the cache in a little while. Reset hidden/system files and folders
Clear & Reset System Restore's Cache
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you don't have them already:
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
09-18-2007, 12:28 PM
|
#11 (permalink) |
|
Registered User
Join Date: Oct 2005
Posts: 70
OS: xp
|
Re: Worm virus Problem
(I can't find it.
It's on show hidden files, all that I see it Outlook express, that can't be it.) After doublechecking your instrustions i found it, I removed it without any problems :) Thank you so much! Last edited by edo; 09-18-2007 at 12:40 PM. |
|
|
|
|
09-18-2007, 12:34 PM
|
#12 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,514
OS: 2000 Pro; XP Pro; XP Home
|
Re: Worm virus Problem
Do you still have ComboFix on the machine? If so, run this script, if not, download afresh, and then run it with this script:
Download combofix.exe to your desktop. Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 09-18-2007 at 12:35 PM. |
|
|
|
|
|
09-18-2007, 12:41 PM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,514
OS: 2000 Pro; XP Pro; XP Home
|
Re: Worm virus Problem
Ahh, I see we cross posted.
No need for the last instructions, then. Good Job!
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
