|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-06-2006, 05:23 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2006
Posts: 5
OS: XP
|
virus is trying to send emails
when i was surfing the net last sunday the norton antivirus pop up said that a virus was detected. backdoor trojan and has already been deleted. so i went on with my surfing and downloading. after a few minutes symantec mini windows appear simultaneously nonstop. it reached 50 windows.then it slowed down my surfing speed. actually i can't do anything anymore. the windows kept on popping up interfering with my surfing then the page load very slowly and almost always results in page error. so i disconnected hoping that when i reconnect the problem will be gone....
so i found out that when i connect to the internet after 2 minutes the common client CC App will appear in the taskbar then a mini symantec window will appear on the lower right or left of my monitor.about 40 windows will appear all at the same time. then the message states "scanning message 1 of 1" when the scanning reached 100% a symantec email proxy window will appear stating "your email message was unable to be sent because your mail server rejected the recepient 452 too many recepients received this hour." or "your email message to <ente60@msn.com> with the subject ----- was unable to be sent because the connection to your mail server was interupted. pls open your mail client and re send msg from the sent message folder" here's the thing... i'm not sending any emails. my yahoo account wasn't even open. i never used my outlook.then the email address attached in the symantec window... i dont know any of them... I have downloaded hijackthis, and have extarcted the following log file. What do I have to do next guys. Please help me. Logfile of HijackThis v1.99.1 Scan saved at 11:56:10 PM, on 6/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32 \winlogon.exe C:\WINDOWS\system32 \services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.5.0_06 \bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr. exe C:\Program Files\Synaptics\SynTP\SynTPEnh. exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Common Files\Real\Update_OB\realsched. exe C:\WINDOWS\system32 \rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateServi ce\issch.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\VCClient\VCMain.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\WINDOWS\system32 \UAService7.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Norton AntiVirus\OPScan.exe C:\Documents and Settings\George\Desktop\hijackt his_sfx.exe C:\Program Files\HijackThis\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Default_Search_UR L = about:blank R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/r dr? TYPE=3&tp=iesearch&locale=EN_AU &c=Q105&bd=presario&pf=laptop R1 - HKCU\Software\Microsoft\Interne t Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Interne t Explorer\Main,Default_Page_URL = about:blank R0 - HKCU\Software\Microsoft\Interne t Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Interne t Explorer\Main,Local Page = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D- 784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0 \ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644- 206D7942484F} - C:\PROGRA~1 \SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB- D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06 \bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333- CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544- FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1- 7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18- 009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32 \igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06 \bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr. exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh. exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1 \IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1 \IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32 \IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32 \IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32 \IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1 \SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [MimBoot] C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched. exe" -osboot O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenti cationAgent O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateServi ce\issch.exe" -start O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" - atboottime O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll /cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll /cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll /cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4 \OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll /cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll /cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5- 00401C608501} - C:\Program Files\Java\jre1.5.0_06 \bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0- 4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06 \bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE- 3C9C571A8263} - C:\PROGRA~1 \MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E- 00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910- F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .m4a: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dl l O14 - IERESET.INF: START_PAGE_URL=http://ie.redire ct.hp.com/svs/rdr? TYPE=3&tp=iehome&locale=EN_AU&c =Q105&bd=presario&pf=laptop O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {15A02B79-60BB-42B8 -814E-BF8364106B9E} (Pco3 Window (Commsec) Control) - http://images.commsec.com.au/do wnloads/pco3/Pco3X_Commsec.cab O16 - DPF: {17492023-C23A-453E -A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/ ?linkid=39204 O16 - DPF: {6414512B-B978-451D -A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microso ft.com/v5consumer/V5Controls/en /x86/client/wuweb_site.cab? 1115639608982 O16 - DPF: {B38870E4-7ECB-40DA -8C6A-595F0A5519FF} (MsnMessengerSetupDownloadContr ol Class) - http://messenger.msn.com/downlo ad/MsnMessengerSetupDownloader. cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F- 8E305202313F} - "C:\PROGRA~1 \MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32 \igfxsrvc.dll O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32 \msupdate32.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11 \Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1 \COMMON~1\SYMANT~1\SCRIPT~1 \SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32 \UAService7.exe |
|
     |
| Sponsored Links |
|
01-06-2006, 12:19 PM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,563
OS: 2000 Pro; XP Pro; XP Home
|
Please repost your log. Turn off the WordWrap (uncheck under Format on the menu bar) feature in Notepad. Also be sure to include all information. Press Ctrl + C, then Ctrl + A, then use Ctrl + V to paste all info in your next reeply.
Thanks.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Please do not ask for help via Private Message. |
|
|
|
|
01-06-2006, 05:10 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2006
Posts: 5
OS: XP
|
I have reposted my log, without the word wrap
Logfile of HijackThis v1.99.1 Scan saved at 11:56:10 PM, on 6/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\VCClient\VCMain.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Norton AntiVirus\OPScan.exe C:\Documents and Settings\George\Desktop\hijackthis_sfx.exe C:\Program Files\HijackThis\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ario&pf=laptop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [MimBoot] C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .m4a: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_AU&c=Q105&bd=presario&pf=laptop O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {15A02B79-60BB-42B8-814E-BF8364106B9E} (Pco3 Window (Commsec) Control) - http://images.commsec.com.au/downloa...3X_Commsec.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1115639608982 O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe |
|
|
|
|
01-06-2006, 05:45 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,563
OS: 2000 Pro; XP Pro; XP Home
|
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Please download Ad-aware at http://www.lavasoftusa.com/ and install it if you don't have it already. Make sure it's the newest version and check for any updates before running it. Also go to http://www.lavasoftusa.com/software/...2cleaner.shtml to download the plug-in for fixing VX2 variants. To run this tool, go into Ad-aware->Add-ons and select VX2 Cleaner. Then click Run Tool and OK to start it. If it's clean, it will say Status System Clean. Otherwise, you will have to click on the Clean button to remove the VX2 infection. Also make sure to customize the settings in Ad-aware at http://www.greyknight17.com/spyware.htm#adaware for better scan results. Run the scan and fix everything that it finds. Download CWShredder and run it. Click on 'I Agree' button if you agree. Click on 'Fix' (it will automatically fix anything it finds for you) and then click OK. If it asks if you want to delete a certain random file, choose No and post that filename here. Let it finish the scan and then hit Next and Exit. I see you have Ewido already. Please update it's definitions, and run a scan where I have placed it in this fix. You will need to update Ewido to the latest definition files.
If you are having problems with the updater, you can use this link to manually update Ewido When you have finished updating, EXIT Ewido. The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link doesn't work) and install it. *NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility. Please disable Microsoft AntiSpyware, as it may hinder the removal of some entries. You can re-enable it after you're clean.
Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider to Standard CleanUp! 3. Uncheck the following:
5. Press the CleanUp! button to start the program. Reboot/logoff when prompted. * CleanUp! will not create any backups!! Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
** Ewido scan would require at least an hour. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ario&pf=laptop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_AU&c=Q105&bd=presar io&pf=laptop O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Click Yes to confirm and then click OK. Delete the following Files/Folders if they exist: C:\Program Files\Common Files\VCClient C:\WINDOWS\SYSTEM32\msupdate32.dll Restart in normal mode. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Restart and run a new HijackThis scan. Save the log file and post it here. Please return with logs from: Ewido Kaspersky online scan HJT
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
01-07-2006, 02:40 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2006
Posts: 5
OS: XP
|
Thanks for that, I did everything you told me.
Here are my log files. Ewido --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 3:34:38 PM, 7/01/2006 + Report-Checksum: B6F63F95 + Scan result: No infected objects found. ::Report End Kaspersky ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Saturday, January 07, 2006 21:27:45 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 7/01/2006 Kaspersky Anti-Virus database records: 169568 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 49957 Number of viruses found: 29 Number of infected objects: 239 Number of suspicious objects: 3 Duration of the scan process: 4494 sec Infected Object Name - Virus Name C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-10015c94-60baf75c.zip/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-10015c94-60baf75c.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-10015c94-60baf75c.zip Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-28679adb-6c32489b.zip/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-28679adb-6c32489b.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-28679adb-6c32489b.zip Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-7ebfe046-20d1db19.zip/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-7ebfe046-20d1db19.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-7ebfe046-20d1db19.zip Infected: Trojan-Downloader.Java.OpenConnection.aj C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv405.jar-5d148c75-657eaff4.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv405.jar-5d148c75-657eaff4.zip Infected: Trojan-Downloader.Java.OpenStream.c C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv441.jar-e736495-624f50c3.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv441.jar-e736495-624f50c3.zip Infected: Trojan-Downloader.Java.OpenStream.c C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv599.jar-75fa518e-3f737a8b.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c C:\Documents and Settings\George\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv599.jar-75fa518e-3f737a8b.zip Infected: Trojan-Downloader.Java.OpenStream.c C:\Documents and Settings\George\My Documents\Warez\WarezP2P_DLC.exe/stream/data0035 Infected: not-a-virus:AdWare.Win32.NewDotNet C:\Documents and Settings\George\My Documents\Warez\WarezP2P_DLC.exe/stream Infected: not-a-virus:AdWare.Win32.NewDotNet C:\Documents and Settings\George\My Documents\Warez\WarezP2P_DLC.exe Infected: not-a-virus:AdWare.Win32.NewDotNet C:\Program Files\Norton AntiVirus\Quarantine\00307D3A.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\003D252C.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\Program Files\Norton AntiVirus\Quarantine\00472321.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\04816932.exe Infected: Trojan-Downloader.Win32.Small.cdk C:\Program Files\Norton AntiVirus\Quarantine\0484132F.dll Infected: Trojan-PSW.Win32.Agent.bu C:\Program Files\Norton AntiVirus\Quarantine\04AC0B04.sys Infected: SpamTool.Win32.Mailbot.b C:\Program Files\Norton AntiVirus\Quarantine\07E7395E.exe Infected: Trojan-Downloader.Win32.Zlob.v C:\Program Files\Norton AntiVirus\Quarantine\096D5501.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\0F297897.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\0FFA77B1.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\100475A7.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\100E739C.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\Program Files\Norton AntiVirus\Quarantine\10144795.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\1145186E.htm Infected: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\1148426B.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\114F1663.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\114F1663.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\114F1663.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\114F1663.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\114F1663.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\11556A5C.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\115F6851.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\11663C4A.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\11CA53A6.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\1391087C.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\1391087C.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\1391087C.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\1391087C.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\1391087C.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\14113205.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\145963E2.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\145C0DDE.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\149A4284.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\15133D15.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\Program Files\Norton AntiVirus\Quarantine\15230F03.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\154108E3.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\154A06D8.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\Program Files\Norton AntiVirus\Quarantine\15515AD1.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\1F5F7721.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\1FA16E04 Infected: Trojan-Downloader.Win32.Qoologic.at C:\Program Files\Norton AntiVirus\Quarantine\1FE26AA2.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\1FE26AA2.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\1FE26AA2.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\1FE26AA2.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\1FE26AA2.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\1FE83E9B.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\1FF5668C.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\1FFC3A85.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\258F7BCC.cab/MediaAccX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ak C:\Program Files\Norton AntiVirus\Quarantine\258F7BCC.cab Infected: not-a-virus:AdWare.Win32.WinAD.ak C:\Program Files\Norton AntiVirus\Quarantine\2B322A03.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\2B322A03.exe Infected: Trojan-Downloader.Win32.Qoologic.at C:\Program Files\Norton AntiVirus\Quarantine\2B5D04C5.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\2B6602BA.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\2B6602BA.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\2B6602BA.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\2B6602BA.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\2B6602BA.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\2B847C9A.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\2BAB746F.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\2BBB465D.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\2BC86E4F.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\2E283E38.dll Infected: Trojan-PSW.Win32.Agent.bu C:\Program Files\Norton AntiVirus\Quarantine\2E2C6834.dll Infected: Trojan-Spy.Win32.Small.dg C:\Program Files\Norton AntiVirus\Quarantine\2EFC280B.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\2EFC280B.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\2EFC280B.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\2EFC280B.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\2EFF5208.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\2FDC629B.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\316034E3.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\316034E3.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\316034E3.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\316034E3.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\316034E3.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\316034E3.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\316708DC.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\316D5CD4.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\317430CD.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\323133FD.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\323133FD.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\323133FD.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\323133FD.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\36C26601.dll Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\395E352D.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\3C083729.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\3DC7269F.zip/a.class Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\3DC7269F.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\3DC7269F.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.u C:\Program Files\Norton AntiVirus\Quarantine\3DC7269F.zip Infected: Trojan.Java.ClassLoader.u C:\Program Files\Norton AntiVirus\Quarantine\3DCA509C.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\3DD12494.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\3DD7788D.cla Infected: Trojan.Java.ClassLoader.u C:\Program Files\Norton AntiVirus\Quarantine\41F306B7.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\Program Files\Norton AntiVirus\Quarantine\42247C81.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\422B507A.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\422B507A.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\422B507A.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\422B507A.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\422B507A.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\42312473.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\423B2268.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\42427661.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\42891212.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\42FF6F8E.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\4302198A.cla Infected: Trojan.Java.ClassLoader.u C:\Program Files\Norton AntiVirus\Quarantine\438858C0.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\438858C0.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\438858C0.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\438858C0.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\438858C0.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\43E7148F.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\Program Files\Norton AntiVirus\Quarantine\45DC334C.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\45DC334C.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\45DC334C.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\45DC334C.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\48964C4C.exe Infected: not-virus:Hoax.Win32.Renos.aj C:\Program Files\Norton AntiVirus\Quarantine\48CA6C12.exe Infected: not-virus:Hoax.Win32.Renos.aj C:\Program Files\Norton AntiVirus\Quarantine\4C3D1C77.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\4EEE79D8.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\5081341B.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\52212716.gif Infected: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\52212716.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\52277B0E.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\52277B0E.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\52277B0E.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\52277B0E.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\52277B0E.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\56391D27.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\56464518.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\5650430D.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\59D21344.htm Infected: Trojan-Downloader.JS.IstBar.j C:\Program Files\Norton AntiVirus\Quarantine\59D91005.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\5B662FCC.dll Infected: Trojan-Spy.Win32.Small.dg C:\Program Files\Norton AntiVirus\Quarantine\5CA97552.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\5CA97552.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\5CA97552.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\5CA97552.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\60785256.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\613A37B4.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\613A37B4.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\614435A9.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\614A09A2.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\621E32B9.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\Program Files\Norton AntiVirus\Quarantine\65694C03.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6767643B.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\Program Files\Norton AntiVirus\Quarantine\67E973AB.htm Suspicious: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\68213D6E.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\682B3B63.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\Program Files\Norton AntiVirus\Quarantine\682E6560.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\683B0D51.htm Infected: Exploit.HTML.Mht C:\Program Files\Norton AntiVirus\Quarantine\683E374E.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\68450B47.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\68450B47.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\68450B47.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\68450B47.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\68450B47.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\684B5F3F.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\68523338.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\685F5B2A.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\68620526.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\6B4A1F8A.exe Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B4D4987.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B5A7178.exe Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B5A7178.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B614571.exe Infected: Trojan.Win32.Inject.i C:\Program Files\Norton AntiVirus\Quarantine\6B646F6D.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B6A4366.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B6E6D63.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B71175F.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B74415B.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B7B1554.exe Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B7B1554.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B851349.exe Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B851349.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B956537.exe Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6B956537.txt Infected: Packed.Win32.Klone.b C:\Program Files\Norton AntiVirus\Quarantine\6C3F6C7D.exe Infected: Trojan-Clicker.Win32.VB.kc C:\Program Files\Norton AntiVirus\Quarantine\6E4457D0.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\6E4E55C6.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\6E4E55C6.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\6E4E55C6.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\6E4E55C6.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\6E4E55C6.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\Program Files\Norton AntiVirus\Quarantine\6E5429BE.cla Infected: Trojan.Java.ClassLoader.c C:\Program Files\Norton AntiVirus\Quarantine\6E5753BB.htm Infected: Exploit.VBS.Phel.a C:\Program Files\Norton AntiVirus\Quarantine\6E5B7DB7.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\6E5E27B4.cla Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\6E6F0813.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E723210.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E755C0C Infected: Trojan-Downloader.Win32.Qoologic.at C:\Program Files\Norton AntiVirus\Quarantine\6E755C0C.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E780608 Infected: Trojan-Downloader.Win32.Qoologic.at C:\Program Files\Norton AntiVirus\Quarantine\6E780608.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E780608.dat Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E7C3005.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E7C3005.exe Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E7F5A01 Infected: Trojan-Downloader.Win32.Qoologic.at C:\Program Files\Norton AntiVirus\Quarantine\6E7F5A01.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6E7F5A01.exe/data0010 Infected: Trojan-Downloader.Win32.Qoologic.at C:\Program Files\Norton AntiVirus\Quarantine\6E7F5A01.exe Infected: Trojan-Downloader.Win32.Qoologic.at C:\Program Files\Norton AntiVirus\Quarantine\6E8203FE.dll Infected: Trojan-Downloader.Win32.Qoologic.ax C:\Program Files\Norton AntiVirus\Quarantine\6ECD4E56.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\71531019.cla Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\71531019.zip/a.class Infected: Trojan.Java.ClassLoader.b C:\Program Files\Norton AntiVirus\Quarantine\71531019.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\71531019.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.u C:\Program Files\Norton AntiVirus\Quarantine\71531019.zip Infected: Trojan.Java.ClassLoader.u C:\Program Files\Norton AntiVirus\Quarantine\71563A16.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\Program Files\Norton AntiVirus\Quarantine\715A6412.cla Infected: Trojan.Java.ClassLoader.u C:\Program Files\Norton AntiVirus\Quarantine\719A4E97.exe Infected: Trojan.Win32.Inject.i C:\Program Files\Norton AntiVirus\Quarantine\73CE65F2.dll Infected: Trojan-Spy.Win32.Small.dg C:\Program Files\Norton AntiVirus\Quarantine\7C711A84.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\7C711A84.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\Program Files\Norton AntiVirus\Quarantine\7C711A84.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\Program Files\Norton AntiVirus\Quarantine\7C711A84.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\secure32.html Infected: Trojan.Win32.Harnig.a C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP1\A0000001.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP4\A0001215.sys Infected: SpamTool.Win32.Mailbot.b C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP4\A0001217.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP4\A0001221.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP5\A0001223.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP5\A0001258.exe Infected: Trojan.Win32.Zapchast.ad C:\WINDOWS\secure32.html Infected: Trojan.Win32.Harnig.a Scan process completed. hijackthis Logfile of HijackThis v1.99.1 Scan saved at 9:32:46 PM, on 7/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe C:\Program Files\HijackThis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [MimBoot] C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .m4a: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {15A02B79-60BB-42B8-814E-BF8364106B9E} (Pco3 Window (Commsec) Control) - http://images.commsec.com.au/downloa...3X_Commsec.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1115639608982 O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe |
|
|
|
|
01-07-2006, 04:13 AM
|
#6 (permalink) |
|
Moderator, Microsoft Support
Join Date: Jul 2004
Location: United Kingdom
Posts: 6,420
OS: XP SP2
|
Please delete this file:
C:\WINDOWS\secure32.html Empty Nortons Quarantine. You can do this via Norton or by navigating to this folder and selecting all contained items and the deleting them. C:\Program Files\Norton AntiVirus\Quarantine\ Delete this folder: C:\Documents and Settings\George\My Documents\Warez\ Clear Java Cache
Follow the instructions outlined here to clear Sun Java's cache. Reboot your computer, rescan with Kapersky and HJT and post the logs in your next post.
__________________
  |
|
|
|
|
01-07-2006, 07:07 AM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2006
Posts: 5
OS: XP
|
Thank you,
Here are my log files ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Sunday, January 08, 2006 01:51:56 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 7/01/2006 Kaspersky Anti-Virus database records: 169341 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 49923 Number of viruses found: 27 Number of infected objects: 224 Number of suspicious objects: 3 Duration of the scan process: 4511 sec Infected Object Name - Virus Name C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc10 Infected: Trojan-Downloader.Win32.Qoologic.at C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc100.exe Infected: not-virus:Hoax.Win32.Renos.aj C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc102.htm Infected: Trojan-Downloader.JS.IstBar.j C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc103.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc104.htm Suspicious: Exploit.HTML.Mht C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc105.dll Infected: Trojan-Spy.Win32.Small.dg C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc106.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc107.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc108.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc108.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc108.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc108.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc108.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc109.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc111.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc112.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc113.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc114.cab/MediaAccX.dll Infected: not-a-virus:AdWare.Win32.WinAD.ak C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc114.cab Infected: not-a-virus:AdWare.Win32.WinAD.ak C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc116.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc117.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc118.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc119.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc119.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc119.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc119.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc119.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc12.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc12.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc12.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc12.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc12.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc120.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc124.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc125.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc126.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc127.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc129.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc13.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc130.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc131.htm Infected: Exploit.HTML.Mht C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc132.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc133.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc134.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc135.cla Infected: Trojan.Java.ClassLoader.u C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc136.exe Infected: Trojan.Win32.Inject.i C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc137.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc138.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc14.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc140.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc141.htm Suspicious: Exploit.HTML.Mht C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc142.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc143.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc144.exe Infected: not-virus:Hoax.Win32.Renos.aj C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc145.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc145.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc145.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc145.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc145.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc148.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc149.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc15.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc150.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc151.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc151.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc151.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc151.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc151.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc152.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc153.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc154.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc155.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc157.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc158.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc158.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc158.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc158.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc158.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc159.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc160.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc161.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc161.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc161.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc161.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc162.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc162.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc162.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc162.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc162.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc163.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc164.dll Infected: Trojan-PSW.Win32.Agent.bu C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc165.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc166.htm Infected: Exploit.HTML.Mht C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc167.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc168.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc168.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc168.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc168.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc168.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc17.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc171.cla Infected: Trojan.Java.ClassLoader.u C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc172.exe Infected: Trojan-Downloader.Win32.Small.cdk C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc174.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc175.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc176.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc177.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc18.exe Infected: Trojan-Downloader.Win32.Qoologic.at C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc180.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc181.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc182.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc183.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc184.gif Infected: Exploit.HTML.Mht C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc185.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc186.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc188.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc189.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc19.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc190.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc191.zip/a.class Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc191.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc191.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.u C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc191.zip Infected: Trojan.Java.ClassLoader.u C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc192.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc193\WarezP2P_DLC.exe/stream/data0035 Infected: not-a-virus:AdWare.Win32.NewDotNet C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc193\WarezP2P_DLC.exe/stream Infected: not-a-virus:AdWare.Win32.NewDotNet C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc193\WarezP2P_DLC.exe Infected: not-a-virus:AdWare.Win32.NewDotNet C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc20.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc21.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc21.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc21.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc21.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc21.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc22.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc24.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc25.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc27.dll Infected: Trojan-Spy.Win32.Small.dg C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc28.dll Infected: Trojan-PSW.Win32.Agent.bu C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc29.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc29.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc29.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc29.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc3.html Infected: Trojan.Win32.Harnig.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc30.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc32.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc34.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc36.cla Infected: Trojan.Java.ClassLoader.Dummy.d C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc37.zip/a.class Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc37.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc37.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.u C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc37.zip Infected: Trojan.Java.ClassLoader.u C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc38.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc39.cla Infected: Trojan.Java.ClassLoader.u C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc40.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc42.sys Infected: SpamTool.Win32.Mailbot.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc43.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc44.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc45.dll Infected: Trojan-Spy.Win32.Small.dg C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc46.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc46.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc46.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc46.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc49.exe Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc50.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc51.exe Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc52.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc53.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc54.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc55.exe Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc56.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc57.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc58.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc59.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc60.exe Infected: Trojan.Win32.Inject.i C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc61.exe Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc62.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc63.exe Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc64.txt Infected: Packed.Win32.Klone.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc66.exe Infected: Trojan-Clicker.Win32.VB.kc C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc67.zip/GetAccess.class Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc67.zip/InsecureClassLoader.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc67.zip/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc67.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc67.zip Infected: Trojan-Downloader.Java.OpenConnection.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc68.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc69.cla Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc7.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc70.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc71.exe Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc72.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc73 Infected: Trojan-Downloader.Win32.Qoologic.at C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc74.exe/data0010 Infected: Trojan-Downloader.Win32.Qoologic.at C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc74.exe Infected: Trojan-Downloader.Win32.Qoologic.at C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc75.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc76 Infected: Trojan-Downloader.Win32.Qoologic.at C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc77.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc79.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc8.htm Suspicious: Exploit.HTML.Mht C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc80.cla Infected: Trojan.Java.ClassLoader.c C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc81.htm Infected: Exploit.VBS.Phel.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc82.dll Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc83.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc84 Infected: Trojan-Downloader.Win32.Qoologic.at C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc85.asq Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc86.dat Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc87.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc88.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc88.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc88.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc88.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc9.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc90.exe Infected: Trojan-Downloader.Win32.Zlob.v C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc92.cla Infected: Trojan.Java.ClassLoader.Dummy.a C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc94.dll Infected: Trojan-Downloader.Win32.Qoologic.ax C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc95.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc97.cla Infected: Trojan.Java.ClassLoader.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc98.htm Infected: Trojan-Clicker.HTML.IFrame.b C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc99.zip/BlackBox.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc99.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc99.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa C:\RECYCLER\S-1-5-21-1418244902-587212499-1075152445-1006\Dc99.zip Infected: Trojan-Downloader.Java.OpenConnection.aa C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP1\A0000001.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP4\A0001215.sys Infected: SpamTool.Win32.Mailbot.b C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP4\A0001217.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP4\A0001221.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP5\A0001223.exe Infected: Trojan.Win32.Zapchast.ad C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP5\A0001258.exe Infected: Trojan.Win32.Zapchast.ad C:\WINDOWS\secure32.html Infected: Trojan.Win32.Harnig.a Scan process completed. Logfile of HijackThis v1.99.1 Scan saved at 9:32:46 PM, on 7/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe C:\Program Files\HijackThis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [MimBoot] C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .m4a: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/k...an_unicode.cab O16 - DPF: {15A02B79-60BB-42B8-814E-BF8364106B9E} (Pco3 Window (Commsec) Control) - http://images.commsec.com.au/downloa...3X_Commsec.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1115639608982 O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe |
|
|
|
|
01-07-2006, 07:23 AM
|
#8 (permalink) |
|
Moderator, Microsoft Support
Join Date: Jul 2004
Location: United Kingdom
Posts: 6,420
OS: XP SP2
|
Hi.
This file still needs to be deleted: C:\WINDOWS\secure32.html Try deleting it in Safe Mode if you struggle to remove it. Keep checking for it's existence until you can no longer find it. Open up Windows Explorer. In the Address bar type or copy and paste. C:\RECYCLER It should display the contents of the recycler folder. Using the keyboard, press CTRL +A and the hit the Delete key. How is your system performing now?
__________________
|
|
|
|
|
01-12-2006, 08:30 AM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,563
OS: 2000 Pro; XP Pro; XP Home
|
Well done. Your logs are clean. Any more issues? If not you should be good to go. We still have a few items to address.
Reset hidden/system files and folders
Create a new System Restore point
Enable Windows Auto Update
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:
If you do not have a firewall, here are 4 free ones available for personal use: In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
| Thread Tools | |
|
|
