Virtumonde problems here [Archive] - Safer-Networking Forums

View Full Version : Virtumonde problems here

Sunny6

2007-08-24, 06:31

I followed the advise you guys were giving all the other nice folk here and I seem to have defeated this thing but I wanted to give you specs anyway and make sure all is well

Sunny6

2007-08-24, 06:32

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:36, on 2007-08-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: SIMON.CMD
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173819835655
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = crownreliance.local
O17 - HKLM\Software\..\Telephony: DomainName = crownreliance.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0DA6FD3-0021-4213-A3B3-871A9B66CE92}: NameServer = 192.168.2.2,4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD900205-2179-461B-A9B4-1122573303D3}: NameServer = 192.168.2.2,4.2.2.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = crownreliance.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = crownreliance.local
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9339 bytes

Sunny6

2007-08-24, 06:33

ComboFix 07-08-24.4 - "user3" 2007-08-23 21:09:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.85 [GMT -7:00]

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Owner\APPLIC~1\microsoft\internet explorer\quick launch\intern~1.lnk
C:\DOCUME~1\Owner\Desktop\internet explorer.lnk
C:\DOCUME~1\user3\Desktop\internet.lnk
C:\DOCUME~1\user3\STARTM~1\Programs\Startup.\TA_Start.lnk
C:\DOCUME~1\user3\STARTM~1\Programs\Startup\ta_start.lnk
C:\Program Files\Online Services\niwo22011.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\kjllm.bak1
C:\WINDOWS\system32\kjllm.ini
C:\WINDOWS\system32\kjllm.ini2
C:\WINDOWS\system32\kjllm.tmp
C:\WINDOWS\system32\mlljk.dll
C:\WINDOWS\system32\ssttstu.dll
C:\WINDOWS\system32\system
C:\WINDOWS\system32\system\msxml4.dll
C:\WINDOWS\system32\system\msxml4r.dll
C:\WINDOWS\system32\yayyawv.dll
D:\Autorun.inf

((((((((((((((((((((((((( Files Created from 2007-07-24 to 2007-08-24 )))))))))))))))))))))))))))))))

2007-08-23 21:08 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-23 18:33 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
2007-08-23 18:31 <DIR> d-------- C:\WINDOWS\system32\IBD4
2007-08-23 18:31 <DIR> d-------- C:\WINDOWS\system32\cofig32
2007-08-17 10:32 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-08-17 10:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-07-25 17:13 58,480 --a------ C:\DOCUME~1\user3\APPLIC~1\GDIPFONTCACHEV1.DAT

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-23 21:15 --------- d-------- C:\Program Files\Symantec AntiVirus
2007-08-23 21:12 --------- d-------- C:\Program Files\Online Services
2007-08-23 19:35 --------- d--h----- C:\DOCUME~1\user3\APPLIC~1\IJJIGame
2007-08-23 19:35 --------- d--h----- C:\DOCUME~1\user3\APPLIC~1\IJJIGame
2007-08-21 13:05 --------- d-------- C:\Program Files\QuickTime
2007-07-17 17:06 --------- d-------- C:\Program Files\InterActual
2007-06-29 12:09 --------- d-------- C:\DOCUME~1\user3\APPLIC~1\Leadertech
2007-06-29 12:09 --------- d-------- C:\DOCUME~1\user3\APPLIC~1\Leadertech
2007-06-28 12:02 --------- d-------- C:\DOCUME~1\user3\APPLIC~1\AdobeAUM
2007-06-28 12:02 --------- d-------- C:\DOCUME~1\user3\APPLIC~1\AdobeAUM
2007-06-25 23:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-19 06:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 03:23 1033216 --a------ C:\WINDOWS\explorer.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 13:42]
"SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 16:04]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 16:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 16:55]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 16:51]
"CHotkey"="zHotkey.exe" [2004-05-17 19:30 C:\WINDOWS\zHotkey.exe]
"ShowWnd"="ShowWnd.exe" [2003-09-19 10:09 C:\WINDOWS\ShowWnd.exe]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-02-14 18:34]
"SoundMan"="SOUNDMAN.EXE" [2004-09-23 20:27 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-09-24 19:06 C:\WINDOWS\ALCWZRD.EXE]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-12-23 11:36]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 05:40]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-02-13 06:05]
"nwiz"="nwiz.exe" [2006-02-13 06:05 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-02-13 06:05]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-04-08 15:52]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-04-17 12:30]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-07 13:56]

C:\DOCUME~1\user3\STARTM~1\Programs\Startup\
SIMON.CMD [2006-04-06 16:42:56]

S3 dump_wmimmc;dump_wmimmc;\??\C:\Program Files\QuickTime\ENGLISH\Gunbound Revolution\GameGuard\dump_wmimmc.sys

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-23 21:15:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-23 21:16:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-23 21:16

--- E O F ---

Sunny6

2007-08-24, 22:24

Hi I just wanted to check and bump my post to see if I need to do anything furthur to remove VM

pskelley

2007-08-26, 20:37

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page
Posted at the top of the forum is the advice you should have followed.
Posting additional comments or logs before a volunteer responds, can push you back instead of forward, because your thread ends up with a newer date. Also, helpers may think you are already being assisted because of the post count. The same applies to 'bumping'. http://forums.spybot.info/showthread.php?t=16806
You should read all of the pinned (sticky) information, it is there for your benefit.

If you still have malware issues, post a new HJT tell me what the symptoms of the malware is and then wait patiently until I have the time to respond.

Thanks

Sunny6

2007-08-29, 03:12

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:15, on 8/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: SIMON.CMD
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173819835655
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = crownreliance.local
O17 - HKLM\Software\..\Telephony: DomainName = crownreliance.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0DA6FD3-0021-4213-A3B3-871A9B66CE92}: NameServer = 192.168.2.2,4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD900205-2179-461B-A9B4-1122573303D3}: NameServer = 192.168.2.2,4.2.2.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = crownreliance.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = crownreliance.local
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9459 bytes

Sunny6

2007-08-29, 20:05

... I think I got rid of it but I never got a reply and Now my topic seems to be missing. Can I please get a response to if my system is clean now or not

Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:08, on 8/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: SIMON.CMD
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173819835655
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = crownreliance.local
O17 - HKLM\Software\..\Telephony: DomainName = crownreliance.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0DA6FD3-0021-4213-A3B3-871A9B66CE92}: NameServer = 192.168.2.2,4.2.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD900205-2179-461B-A9B4-1122573303D3}: NameServer = 192.168.2.2,4.2.2.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = crownreliance.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = crownreliance.local
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9516 bytes

tashi

2007-08-29, 20:57

Sunny6, you appear to be a little lost here.

Please do not start new topics, post your responses into this thread.

Also as pskelley pointed out, reading the sticky topics before posting, would avoid such as your bumping.. when we specially ask our members not to do so.

Thank you. ;)

Sunny6

2007-08-29, 21:49

I'm really sorry about that. Yeah I am a little lost here. I just wanted to make sure that I'm now having any malware issues. the post of mine above this is a fresh Hijack taken from this morning. I havent had any noticable malware issues but you guys seem so knowledgeble I thought It couldn't hurt to ask.

pskelley

2007-08-29, 22:14

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:08, on 8/29/2007

The HJT log looks fine, let's run one scan to make sure nothing is hiding.

First remove combofix from your computer, make sure to delete the C:\Qoobox\Quarantine\ folder

Run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

* The program will launch and then begin downloading the latest definition files:
* Once the files have been downloaded click on NEXT
* Now click on Scan Settings
* In the scan settings make that the following are selected:
* Scan using the following Anti-Virus database:
* Standard
* Scan Options:
* Scan Archives
* Scan Mail Bases
* Click OK
* Now under select a target to scan:
* Select My Computer
* This will program will start and scan your system.
* The scan will take a while so be patient and let it run.
* Once the scan is complete it will display if your system has been infected.
* Now click on the Save as Text button:
* Save the file to your desktop.

Then post it here.

Thanks

Sunny6

2007-08-30, 00:40

KASPERSKY ONLINE SCANNER REPORT
08-29-2007 3:40
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 29/08/2007
Kaspersky Anti-Virus database records: 373731
Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
M:\
N:\
S:\
Scan Statistics
Total number of scanned objects 166245
Number of viruses found 3
Number of infected objects 204
Number of suspicious objects 0
Duration of the scan process 02:16:37

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\user3\Application Data\Microsoft\Outlook\Outlook.srs Object is locked skipped
C:\Documents and Settings\user3\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped
C:\Documents and Settings\user3\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\user3\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user3\Local Settings\History\History.IE5\MSHist012007082920070830\index.dat Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Temp\~DF340.tmp Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Temp\~DF3F4F.tmp Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Temp\~DF43E6.tmp Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user3\Local Settings\Temporary Internet Files\Content.IE5\U7IXOTQF\summitcustomers[1].htm Object is locked skipped
C:\Documents and Settings\user3\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\user3\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\Microsoft Office\Office10\Startup\Fpsword.dot Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0265NAV~.TMP Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0493NAV~.TMP Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP288\A0036947.exe Infected: Trojan-Downloader.Win32.VB.awj skipped
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP290\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\cofig32\r1w2821.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Sunny6

2007-08-30, 00:42

D:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP290\change.log Object is locked skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@yahoo.com][Date Sat, 03 Dec 2005 00:04:51 GMT]/reg_pass.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@yahoo.com][Date Sat, 03 Dec 2005 00:04:51 GMT]/reg_pass.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Tue, 06 Dec 2005 00:41:54 UTC]/UNNAMED/reg_pass.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Tue, 06 Dec 2005 00:41:54 UTC]/UNNAMED/reg_pass.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Tue, 06 Dec 2005 00:41:54 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Post@fbi.gov][Date Tue, 06 Dec 2005 02:51:33 GMT]/UNNAMED/UNNAMED/[From Post@fbi.gov][Date Tue, 06 Dec 2005 02:51:33 GMT]/list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Post@fbi.gov][Date Tue, 06 Dec 2005 02:51:33 GMT]/UNNAMED/UNNAMED/[From Post@fbi.gov][Date Tue, 06 Dec 2005 02:51:33 GMT]/list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Post@fbi.gov][Date Tue, 06 Dec 2005 02:51:33 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Post@fbi.gov][Date Tue, 06 Dec 2005 02:51:33 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From emolinarii@hotmail.com][Date Tue, 06 Dec 2005 21:29:19 GMT]/UNNAMED/UNNAMED/[From emolinarii@hotmail.com][Date Tue, 06 Dec 2005 21:29:19 GMT]/mailtext.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From emolinarii@hotmail.com][Date Tue, 06 Dec 2005 21:29:19 GMT]/UNNAMED/UNNAMED/[From emolinarii@hotmail.com][Date Tue, 06 Dec 2005 21:29:19 GMT]/mailtext.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From emolinarii@hotmail.com][Date Tue, 06 Dec 2005 21:29:19 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From emolinarii@hotmail.com][Date Tue, 06 Dec 2005 21:29:19 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@mx.mailix.net][Date Tue, 06 Dec 2005 23:05:35 UTC]/UNNAMED/UNNAMED/[From Admin@mx.mailix.net][Date Tue, 06 Dec 2005 23:05:35 UTC]/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@mx.mailix.net][Date Tue, 06 Dec 2005 23:05:35 UTC]/UNNAMED/UNNAMED/[From Admin@mx.mailix.net][Date Tue, 06 Dec 2005 23:05:35 UTC]/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@mx.mailix.net][Date Tue, 06 Dec 2005 23:05:35 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@mx.mailix.net][Date Tue, 06 Dec 2005 23:05:35 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@jetplastics.com][Date Wed, 07 Dec 2005 19:31:50 UTC]/UNNAMED/UNNAMED/[From postmaster@jetplastics.com][Date Wed, 07 Dec 2005 19:31:50 UTC]/reg_pass-data.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@jetplastics.com][Date Wed, 07 Dec 2005 19:31:50 UTC]/UNNAMED/UNNAMED/[From postmaster@jetplastics.com][Date Wed, 07 Dec 2005 19:31:50 UTC]/reg_pass-data.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@jetplastics.com][Date Wed, 07 Dec 2005 19:31:50 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@jetplastics.com][Date Wed, 07 Dec 2005 19:31:50 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@yahoo.com][Date Wed, 07 Dec 2005 02:03:03 GMT]/UNNAMED/UNNAMED/[From hostmaster@yahoo.com][Date Wed, 07 Dec 2005 02:03:03 GMT]/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@yahoo.com][Date Wed, 07 Dec 2005 02:03:03 GMT]/UNNAMED/UNNAMED/[From hostmaster@yahoo.com][Date Wed, 07 Dec 2005 02:03:03 GMT]/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@yahoo.com][Date Wed, 07 Dec 2005 02:03:03 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@yahoo.com][Date Wed, 07 Dec 2005 02:03:03 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@aol.com][Date Wed, 07 Dec 2005 00:41:35 UTC]/UNNAMED/UNNAMED/[From hostmaster@aol.com][Date Wed, 07 Dec 2005 00:41:35 UTC]/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@aol.com][Date Wed, 07 Dec 2005 00:41:35 UTC]/UNNAMED/UNNAMED/[From hostmaster@aol.com][Date Wed, 07 Dec 2005 00:41:35 UTC]/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@aol.com][Date Wed, 07 Dec 2005 00:41:35 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@aol.com][Date Wed, 07 Dec 2005 00:41:35 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@yahoo.com][Date Wed, 07 Dec 2005 22:56:49 GMT]/UNNAMED/UNNAMED/[From webmaster@yahoo.com][Date Wed, 07 Dec 2005 22:56:49 GMT]/reg_pass-data.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@yahoo.com][Date Wed, 07 Dec 2005 22:56:49 GMT]/UNNAMED/UNNAMED/[From webmaster@yahoo.com][Date Wed, 07 Dec 2005 22:56:49 GMT]/reg_pass-data.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@yahoo.com][Date Wed, 07 Dec 2005 22:56:49 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@yahoo.com][Date Wed, 07 Dec 2005 22:56:49 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@fbi.gov][Date Wed, 07 Dec 2005 21:16:49 UTC]/UNNAMED/UNNAMED/[From Admin@fbi.gov][Date Wed, 07 Dec 2005 21:16:49 UTC]/question_list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@fbi.gov][Date Wed, 07 Dec 2005 21:16:49 UTC]/UNNAMED/UNNAMED/[From Admin@fbi.gov][Date Wed, 07 Dec 2005 21:16:49 UTC]/question_list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@fbi.gov][Date Wed, 07 Dec 2005 21:16:49 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@fbi.gov][Date Wed, 07 Dec 2005 21:16:49 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From WICSB@maxitola.com][Date Thu, 08 Dec 2005 00:31:48 GMT]/UNNAMED/UNNAMED/[From WICSB@maxitola.com][Date Thu, 08 Dec 2005 00:31:48 GMT]/mailtext.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From WICSB@maxitola.com][Date Thu, 08 Dec 2005 00:31:48 GMT]/UNNAMED/UNNAMED/[From WICSB@maxitola.com][Date Thu, 08 Dec 2005 00:31:48 GMT]/mailtext.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From WICSB@maxitola.com][Date Thu, 08 Dec 2005 00:31:48 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From WICSB@maxitola.com][Date Thu, 08 Dec 2005 00:31:48 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@nuumaf.com][Date Thu, 08 Dec 2005 22:21:23 UTC]/UNNAMED/UNNAMED/[From webmaster@nuumaf.com][Date Thu, 08 Dec 2005 22:21:23 UTC]/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@nuumaf.com][Date Thu, 08 Dec 2005 22:21:23 UTC]/UNNAMED/UNNAMED/[From webmaster@nuumaf.com][Date Thu, 08 Dec 2005 22:21:23 UTC]/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@nuumaf.com][Date Thu, 08 Dec 2005 22:21:23 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@nuumaf.com][Date Thu, 08 Dec 2005 22:21:23 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From SuperDaveNM8@msn.com][Date Fri, 09 Dec 2005 03:54:24 GMT]/UNNAMED/mailtext.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From SuperDaveNM8@msn.com][Date Fri, 09 Dec 2005 03:54:24 GMT]/UNNAMED/mailtext.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From SuperDaveNM8@msn.com][Date Fri, 09 Dec 2005 03:54:24 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 03:05:39 UTC]/UNNAMED/UNNAMED/[From Mail@cia.gov][Date Fri, 09 Dec 2005 03:05:39 UTC]/question_list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 03:05:39 UTC]/UNNAMED/UNNAMED/[From Mail@cia.gov][Date Fri, 09 Dec 2005 03:05:39 UTC]/question_list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 03:05:39 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 03:05:39 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Fri, 09 Dec 2005 01:29:56 GMT]/UNNAMED/UNNAMED/[From Department@fbi.gov][Date Fri, 09 Dec 2005 01:29:56 GMT]/list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Fri, 09 Dec 2005 01:29:56 GMT]/UNNAMED/UNNAMED/[From Department@fbi.gov][Date Fri, 09 Dec 2005 01:29:56 GMT]/list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Fri, 09 Dec 2005 01:29:56 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Fri, 09 Dec 2005 01:29:56 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@livert.com][Date Fri, 09 Dec 2005 00:01:31 UTC]/UNNAMED/UNNAMED/[From postmaster@livert.com][Date Fri, 09 Dec 2005 00:01:31 UTC]/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@livert.com][Date Fri, 09 Dec 2005 00:01:31 UTC]/UNNAMED/UNNAMED/[From postmaster@livert.com][Date Fri, 09 Dec 2005 00:01:31 UTC]/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@livert.com][Date Fri, 09 Dec 2005 00:01:31 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@livert.com][Date Fri, 09 Dec 2005 00:01:31 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Office@cia.gov][Date Fri, 09 Dec 2005 21:27:06 GMT]/UNNAMED/UNNAMED/[From Office@cia.gov][Date Fri, 09 Dec 2005 21:27:06 GMT]/list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Office@cia.gov][Date Fri, 09 Dec 2005 21:27:06 GMT]/UNNAMED/UNNAMED/[From Office@cia.gov][Date Fri, 09 Dec 2005 21:27:06 GMT]/list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Office@cia.gov][Date Fri, 09 Dec 2005 21:27:06 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Office@cia.gov][Date Fri, 09 Dec 2005 21:27:06 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@fbi.gov][Date Fri, 09 Dec 2005 20:04:22 UTC]/UNNAMED/UNNAMED/[From Mail@fbi.gov][Date Fri, 09 Dec 2005 20:04:22 UTC]/list240.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@fbi.gov][Date Fri, 09 Dec 2005 20:04:22 UTC]/UNNAMED/UNNAMED/[From Mail@fbi.gov][Date Fri, 09 Dec 2005 20:04:22 UTC]/list240.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@fbi.gov][Date Fri, 09 Dec 2005 20:04:22 UTC]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@fbi.gov][Date Fri, 09 Dec 2005 20:04:22 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 22:54:51 GMT]/UNNAMED/UNNAMED/[From Mail@cia.gov][Date Fri, 09 Dec 2005 22:54:51 GMT]/list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 22:54:51 GMT]/UNNAMED/UNNAMED/[From Mail@cia.gov][Date Fri, 09 Dec 2005 22:54:51 GMT]/list.zip Infected: Email-Worm.Win32.Sober.y skipped

Sunny6

2007-08-30, 00:43

F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 22:54:51 GMT]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@cia.gov][Date Fri, 09 Dec 2005 22:54:51 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@cia.gov][Date Tue, 22 Nov 2005 20:04:39 UTC]/UNNAMED/list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@cia.gov][Date Tue, 22 Nov 2005 20:04:39 UTC]/UNNAMED/list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@cia.gov][Date Tue, 22 Nov 2005 20:04:39 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@emailpizzahut.com][Date Tue, 29 Nov 2005 00:53:42 UTC]/UNNAMED/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@emailpizzahut.com][Date Tue, 29 Nov 2005 00:53:42 UTC]/UNNAMED/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@emailpizzahut.com][Date Tue, 29 Nov 2005 00:53:42 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@smcdirect.net][Date Sat, 03 Dec 2005 02:58:02 GMT]/UNNAMED/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@smcdirect.net][Date Sat, 03 Dec 2005 02:58:02 GMT]/UNNAMED/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@smcdirect.net][Date Sat, 03 Dec 2005 02:58:02 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@pacresloan.com][Date Tue, 22 Nov 2005 17:39:11 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@pacresloan.com][Date Tue, 22 Nov 2005 17:39:11 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@pacresloan.com][Date Tue, 22 Nov 2005 17:39:11 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@blackberry.nextel.com][Date Tue, 22 Nov 2005 17:21:52 UTC]/UNNAMED/reg_pass.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@blackberry.nextel.com][Date Tue, 22 Nov 2005 17:21:52 UTC]/UNNAMED/reg_pass.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@blackberry.nextel.com][Date Tue, 22 Nov 2005 17:21:52 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Tue, 22 Nov 2005 02:33:20 UTC]/UNNAMED/question_list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Tue, 22 Nov 2005 02:33:20 UTC]/UNNAMED/question_list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Tue, 22 Nov 2005 02:33:20 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@aol.com][Date Tue, 22 Nov 2005 01:50:25 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@aol.com][Date Tue, 22 Nov 2005 01:50:25 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@aol.com][Date Tue, 22 Nov 2005 01:50:25 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@sbcglobal.net][Date Tue, 22 Nov 2005 20:04:39 UTC]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@sbcglobal.net][Date Tue, 22 Nov 2005 20:04:39 UTC]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@sbcglobal.net][Date Tue, 22 Nov 2005 20:04:39 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@aol.com][Date Tue, 22 Nov 2005 21:04:32 GMT]/UNNAMED/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@aol.com][Date Tue, 22 Nov 2005 21:04:32 GMT]/UNNAMED/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@aol.com][Date Tue, 22 Nov 2005 21:04:32 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@maxivion.com][Date Tue, 22 Nov 2005 22:28:27 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@maxivion.com][Date Tue, 22 Nov 2005 22:28:27 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@maxivion.com][Date Tue, 22 Nov 2005 22:28:27 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@fbi.gov][Date Wed, 23 Nov 2005 17:07:36 GMT]/UNNAMED/question_list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@fbi.gov][Date Wed, 23 Nov 2005 17:07:36 GMT]/UNNAMED/question_list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Mail@fbi.gov][Date Wed, 23 Nov 2005 17:07:36 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@avariscapital.com][Date Wed, 23 Nov 2005 17:07:36 GMT]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@avariscapital.com][Date Wed, 23 Nov 2005 17:07:36 GMT]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@avariscapital.com][Date Wed, 23 Nov 2005 17:07:36 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Post@fbi.gov][Date Wed, 23 Nov 2005 22:49:34 GMT]/UNNAMED/question_list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Post@fbi.gov][Date Wed, 23 Nov 2005 22:49:34 GMT]/UNNAMED/question_list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Post@fbi.gov][Date Wed, 23 Nov 2005 22:49:34 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@healthcare.uiowa.edu][Date Thu, 24 Nov 2005 00:40:33 GMT]/UNNAMED/reg_pass-data.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@healthcare.uiowa.edu][Date Thu, 24 Nov 2005 00:40:33 GMT]/UNNAMED/reg_pass-data.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@healthcare.uiowa.edu][Date Thu, 24 Nov 2005 00:40:33 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Mon, 28 Nov 2005 20:52:04 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Mon, 28 Nov 2005 20:52:04 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Mon, 28 Nov 2005 20:52:04 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@aol.com][Date Mon, 28 Nov 2005 17:10:11 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@aol.com][Date Mon, 28 Nov 2005 17:10:11 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@aol.com][Date Mon, 28 Nov 2005 17:10:11 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@greystonehcm.com][Date Mon, 28 Nov 2005 17:57:31 UTC]/UNNAMED/reg_pass-data.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@greystonehcm.com][Date Mon, 28 Nov 2005 17:57:31 UTC]/UNNAMED/reg_pass-data.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@greystonehcm.com][Date Mon, 28 Nov 2005 17:57:31 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Mon, 28 Nov 2005 22:46:26 GMT]/UNNAMED/list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Mon, 28 Nov 2005 22:46:26 GMT]/UNNAMED/list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Department@fbi.gov][Date Mon, 28 Nov 2005 22:46:26 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@pacresloan.com][Date Mon, 28 Nov 2005 22:46:26 GMT]/UNNAMED/reg_pass.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@pacresloan.com][Date Mon, 28 Nov 2005 22:46:26 GMT]/UNNAMED/reg_pass.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@pacresloan.com][Date Mon, 28 Nov 2005 22:46:26 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@1zzyq8vuxcv8dwmmyvyx97rhp4ddlac5.pacificdot.com][Date Mon, 28 Nov 2005 22:31:47 UTC]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@1zzyq8vuxcv8dwmmyvyx97rhp4ddlac5.pacificdot.com][Date Mon, 28 Nov 2005 22:31:47 UTC]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@1zzyq8vuxcv8dwmmyvyx97rhp4ddlac5.pacificdot.com][Date Mon, 28 Nov 2005 22:31:47 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@pffb.com][Date Mon, 28 Nov 2005 22:28:30 UTC]/UNNAMED/reg_pass-data.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@pffb.com][Date Mon, 28 Nov 2005 22:28:30 UTC]/UNNAMED/reg_pass-data.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@pffb.com][Date Mon, 28 Nov 2005 22:28:30 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@yahoo.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED/reg_pass.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@yahoo.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED/reg_pass.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@yahoo.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@pacresloan.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@pacresloan.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@pacresloan.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@hotmail.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@hotmail.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@hotmail.com][Date Tue, 29 Nov 2005 17:22:44 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Tue, 29 Nov 2005 16:57:14 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skippedF:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Tue, 29 Nov 2005 16:57:14 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Tue, 29 Nov 2005 16:57:14 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@hotmail.com][Date Tue, 29 Nov 2005 16:57:14 GMT]/UNNAMED/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@hotmail.com][Date Tue, 29 Nov 2005 16:57:14 GMT]/UNNAMED/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From hostmaster@hotmail.com][Date Tue, 29 Nov 2005 16:57:14 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@fbi.gov][Date Tue, 29 Nov 2005 01:00:52 GMT]/UNNAMED/list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@fbi.gov][Date Tue, 29 Nov 2005 01:00:52 GMT]/UNNAMED/list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@fbi.gov][Date Tue, 29 Nov 2005 01:00:52 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Office@fbi.gov][Date Tue, 29 Nov 2005 00:02:29 UTC]/UNNAMED/question_list.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Office@fbi.gov][Date Tue, 29 Nov 2005 00:02:29 UTC]/UNNAMED/question_list.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Office@fbi.gov][Date Tue, 29 Nov 2005 00:02:29 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@ecommunity.com][Date Tue, 29 Nov 2005 00:17:09 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@ecommunity.com][Date Tue, 29 Nov 2005 00:17:09 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postmaster@ecommunity.com][Date Tue, 29 Nov 2005 00:17:09 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@hotmail.com][Date Tue, 29 Nov 2005 00:17:09 GMT]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@hotmail.com][Date Tue, 29 Nov 2005 00:17:09 GMT]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Admin@hotmail.com][Date Tue, 29 Nov 2005 00:17:09 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@iswest.com][Date Tue, 29 Nov 2005 00:07:20 GMT]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@iswest.com][Date Tue, 29 Nov 2005 00:07:20 GMT]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@iswest.com][Date Tue, 29 Nov 2005 00:07:20 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@hotmail.com][Date Tue, 29 Nov 2005 00:02:41 UTC]/UNNAMED/mail_body.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@hotmail.com][Date Tue, 29 Nov 2005 00:02:41 UTC]/UNNAMED/mail_body.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@hotmail.com][Date Tue, 29 Nov 2005 00:02:41 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@trenam.com][Date Tue, 29 Nov 2005 17:26:31 UTC]/UNNAMED/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@trenam.com][Date Tue, 29 Nov 2005 17:26:31 UTC]/UNNAMED/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@trenam.com][Date Tue, 29 Nov 2005 17:26:31 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@keltitle.com][Date Tue, 29 Nov 2005 18:22:25 GMT]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@keltitle.com][Date Tue, 29 Nov 2005 18:22:25 GMT]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@keltitle.com][Date Tue, 29 Nov 2005 18:22:25 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From lordyoyo2006@hotmail.com][Date Tue, 29 Nov 2005 22:30:17 UTC]/UNNAMED/mailtext.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From lordyoyo2006@hotmail.com][Date Tue, 29 Nov 2005 22:30:17 UTC]/UNNAMED/mailtext.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From lordyoyo2006@hotmail.com][Date Tue, 29 Nov 2005 22:30:17 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@unionenergy.com][Date Tue, 29 Nov 2005 21:48:39 UTC]/UNNAMED/reg_pass-data.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@unionenergy.com][Date Tue, 29 Nov 2005 21:48:39 UTC]/UNNAMED/reg_pass-data.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@unionenergy.com][Date Tue, 29 Nov 2005 21:48:39 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@epicserver.epicdatasystems.net][Date Tue, 29 Nov 2005 20:44:23 UTC]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@epicserver.epicdatasystems.net][Date Tue, 29 Nov 2005 20:44:23 UTC]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From info@epicserver.epicdatasystems.net][Date Tue, 29 Nov 2005 20:44:23 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@jamony.net][Date Wed, 30 Nov 2005 00:12:32 GMT]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@jamony.net][Date Wed, 30 Nov 2005 00:12:32 GMT]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From office@jamony.net][Date Wed, 30 Nov 2005 00:12:32 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From ea.700cab1a.30478ad4@aol.com][Date Wed, 30 Nov 2005 03:23:24 GMT]/UNNAMED/mailtext.zip/File-packed_dataInfo.exe

Sunny6

2007-08-30, 00:44

Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From ea.700cab1a.30478ad4@aol.com][Date Wed, 30 Nov 2005 03:23:24 GMT]/UNNAMED/mailtext.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From ea.700cab1a.30478ad4@aol.com][Date Wed, 30 Nov 2005 03:23:24 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@documediagrp.com][Date Wed, 30 Nov 2005 01:52:12 UTC]/UNNAMED/mail.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@documediagrp.com][Date Wed, 30 Nov 2005 01:52:12 UTC]/UNNAMED/mail.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@documediagrp.com][Date Wed, 30 Nov 2005 01:52:12 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@azdoa.gov][Date Thu, 01 Dec 2005 02:42:13 GMT]/UNNAMED/downloadm.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@azdoa.gov][Date Thu, 01 Dec 2005 02:42:13 GMT]/UNNAMED/downloadm.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@azdoa.gov][Date Thu, 01 Dec 2005 02:42:13 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Carissa.Memovich@oomc.com][Date Fri, 02 Dec 2005 18:19:32 GMT]/UNNAMED/mailtext.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Carissa.Memovich@oomc.com][Date Fri, 02 Dec 2005 18:19:32 GMT]/UNNAMED/mailtext.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From Carissa.Memovich@oomc.com][Date Fri, 02 Dec 2005 18:19:32 GMT]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@anahize.com][Date Fri, 02 Dec 2005 19:50:58 UTC]/UNNAMED/reg_pass.zip/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@anahize.com][Date Fri, 02 Dec 2005 19:50:58 UTC]/UNNAMED/reg_pass.zip Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX/[From webmaster@anahize.com][Date Fri, 02 Dec 2005 19:50:58 UTC]/UNNAMED Infected: Email-Worm.Win32.Sober.y skipped
F:\PAM\OUTLOOK\DELETEDI.DBX Mail MS Outlook 5: infected - 201 skipped
Scan process completed.

pskelley

2007-08-30, 01:30

I am not sure where to start here, but you have a nasty trojan called Email-Worm.Win32.Sober.y
it appears you have a load of infected email stored. I suggest you navigate to it and delete it all

Here is one of the items, I believe you need to delete all the email you have stored in utlook. I would not take the chance that any is uninfected, you are talking around 200 emails.
F:\PAM\OUTLOOK\DELETEDI.DBX/[From postman@yahoo.com][Date Tue, 06 Dec 2005 00:41:54 UTC]/UNNAMED/reg_pass.zip Infected: Email-Worm.Win32.Sober.y skipped
Once you delete all of the infected email, run Kapspersky again to make sure it all gone. It is not hard to see this stuff, it all starts like this:
F:\PAM\OUTLOOK\

Here is the worm: http://www.google.com/search?hl=en&q=Email-Worm.Win32.Sober.y+&btnG=Google+Search
and we can run scans to make sure it is gone, but you need to start by cleaning out all of the junk you are storing that is infected.

Delete the folder in red
C:\WINDOWS\system32\cofig32\r1w2821.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped

You should probably contact your antivirus http://www.symantec.com/index.jsp
and ask for instructions. I would like to blame them but from all information I am seeing, this is caused when an infected attachment is opened, not much they can do to prevent that.

The do offer a removal tool:

http://www.symantec.com/security_response/writeup.jsp?docid=2003-102909-2446-99

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBER.AG
This tool may remove the infection, look for AUTOMATIC REMOVAL INSTRUCTIONS
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FSOBER%2EAG&VSect=Sn

You have infected System Restore files but we will clean those last, just do not use System Restore until we get it cleaned.
C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP288\A0036947.exe Infected: Trojan-Downloader.Win32.VB.awj skipped

If you are not comfortable working on computers, you may want to ask for help from someone who is, take the computer to a reputable shop for disinfecting it or reformat the system.

Thanks

Sunny6

2007-08-30, 01:35

Okay I can do this as long as someone tells me how. first of all. how do I navigate to delete the emails

Sunny6

2007-08-30, 01:49

Can I just delete all of the DELETEDI.DBX

pskelley

2007-08-30, 02:00

What you need to do is get some help on your end from someone who knows computers. If you do not know anyone, then I suggest you take the computer to a shop, you are badly infected and you need more help than I can provide in a remote cleanup with your obvious lack of experience. As I pointed out, you may be able to get help from your antivirus company.
I have already provided you with about all of the information I can.

Thanks

Sunny6

2007-08-30, 02:01

alright thank you much

pskelley

2007-09-01, 14:23

This member needs local help.
As the problem appears to be resolved this topic has been closed.

If you need it re-opened please send me or a forum staff member a private message (pm) and provide a link to the thread; this applies only to the original topic starter.

Anyone else with similar problems please start a new topic.

Thanks