A lot of pop-ups [Archive] - Safer-Networking Forums

jordiet

2007-09-10, 12:47

First, sorry for my bad english

At start-up, my Av (McAfee) show me a windoy with "Generic Dowloader Detecte". After, if I pas Spybot S&D or similars no remove it good. When I open Mozilla, automaticly, but not everytime, IE open by himself.

I paste log file from HijakThis (Karsperski in new message, it's too long for the same post)
Sorry if I make some mistakes i this post and thank-you in advance

Logfile of HijackThis v1.99.1
Scan saved at 1:34:48, on 10/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\Explorer.EXE
C:\Archivos de programa\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS2\system32\drivers\CDAC11BA.EXE
C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe
C:\Archivos de programa\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Archivos de programa\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Archivos de programa\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Archivos de programa\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS2\system32\nvsvc32.exe
C:\WINDOWS2\System32\svchost.exe
C:\Archivos de programa\Logitech\iTouch\iTouch.exe
C:\WINDOWS2\system32\dla\tfswctrl.exe
C:\Archivos de programa\Archivos comunes\InstallShield\UpdateService\issch.exe
C:\Archivos de programa\Java\jre1.6.0_02\bin\jusched.exe
C:\Archivos de programa\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Archivos de programa\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Archivos de programa\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS2\SOUNDMAN.EXE
C:\WINDOWS2\system32\ctfmon.exe
C:\WINDOWS2\system32\rundll32.exe
C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Archivos de programa\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe
C:\Archivos de programa\Logitech\MouseWare\system\em_exec.exe
C:\Archivos de programa\McAfee\Common Framework\McTray.exe
C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Archivos de programa\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Archivos de programa\eMule\eMule.exe
C:\Archivos de programa\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\Archivos de programa\Spybot - Search & Destroy\SpybotSD.exe
C:\Archivos de programa\Winamp\winamp.exe
C:\WINDOWS2\System32\HPZipm12.exe
C:\WINDOWS2\system32\svchost.exe
C:\DISC DADES ANTIC\Curs 2007-2008\soft download\hijack this - arxiu log dels antivurs per penjar als foros\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Archivos de programa\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS2\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Archivos de programa\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Archivos de programa\FlashGet\getflash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar4.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS2\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS2\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [dla] C:\WINDOWS2\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\ARCHIV~1\ARCHIV~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Archivos de programa\Archivos comunes\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS2\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Archivos de programa\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Archivos de programa\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS2\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OrderReminder] C:\Archivos de programa\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Archivos de programa\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Archivos de programa\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Flashget] C:\Archivos de programa\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uev] C:\WINDOWS2\system32\?dobe\?ti2evxx.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Acelerador de inicio de AutoCAD.lnk = C:\Archivos de programa\Archivos comunes\Autodesk Shared\acstart16.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Pinnacle Scheduler.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Archivos de programa\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Archivos de programa\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARCHIV~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\ARCHIV~1\ICQ\ICQ.exe
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Archivos de programa\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Archivos de programa\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar1.google.com/data/ca/big/1.1.62-big/GoogleNav.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{41F24508-54AF-4C77-AC47-3F894D086E84}: NameServer = 195.75.8.3,195.77.8.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{ACF63032-15D4-42AE-905F-451CBCF83EEE}: NameServer = 195.75.8.3,195.77.8.10
O17 - HKLM\System\CS1\Services\Tcpip\..\{41F24508-54AF-4C77-AC47-3F894D086E84}: NameServer = 195.75.8.3,195.77.8.10
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Archivos de programa\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS2\system32\drivers\CDAC11BA.EXE
O23 - Service: Client IP-IPX - Unknown owner - ".exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Archivos de programa\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Archivos de programa\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Archivos de programa\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Archivos de programa\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS2\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS2\System32\HPZipm12.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Archivos de programa\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Archivos de programa\Spyware Doctor\swdsvc.exe

jordiet

2007-09-10, 12:48

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, September 10, 2007 9:38:22 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 10/09/2007
Kaspersky Anti-Virus database records: 410664
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 238416
Number of viruses found: 4
Number of infected objects: 11
Number of suspicious objects: 0
Duration of the scan process: 03:33:34

Infected Object Name / Virus Name / Last Action
C:\Archivos de programa\eMule\Incoming\ad aware 2007 serial.exe/data0007 Infected: Trojan.Win32.Obfuscated.en skipped
C:\Archivos de programa\eMule\Incoming\ad aware 2007 serial.exe NSIS: infected - 1 skipped
C:\Archivos de programa\eMule\Temp\002.part Object is locked skipped
C:\Archivos de programa\eMule\Temp\006.part Object is locked skipped
C:\Archivos de programa\eMule\Temp\007.part Object is locked skipped
C:\DISC DADES ANTIC\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe/data0011/SaveNow.exe Infected: not-a-virus:AdWare.Win32.SaveNow.av skipped
C:\DISC DADES ANTIC\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe/data0011/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.au skipped
C:\DISC DADES ANTIC\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe/data0011 Infected: not-a-virus:AdWare.Win32.SaveNow.au skipped
C:\DISC DADES ANTIC\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe Inno: infected - 3 skipped
C:\Documents and Settings\All Users\Datos de programa\McAfee\Common Framework\Db\Agent_PC-CASA.log Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\McAfee\Common Framework\Db\PrdMgr_PC-CASA.log Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\McAfee\DesktopProtection\AccessProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\McAfee\DesktopProtection\BufferOverflowProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Archivos temporales de Internet\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Temp\IMG4C7.tmp Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Temp\NAILogs\UpdaterUI_PC-CASA.log Object is locked skipped
C:\Documents and Settings\Familia\Configuración local\Temp\~DF2595.tmp Object is locked skipped
C:\Documents and Settings\Familia\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\cert8.db Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\flashgot.log Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\history.dat Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\key3.db Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\parent.lock Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Familia\Datos de programa\Mozilla\Firefox\Profiles\nlazz4x3.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Familia\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Familia\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\itouch_crash_info.txt Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{19B77D3F-9E2F-47F8-A841-C4DBF34F17DE}\RP439\change.log Object is locked skipped
C:\WINDOWS2\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS2\SchedLgU.Txt Object is locked skipped
C:\WINDOWS2\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS2\Sti_Trace.log Object is locked skipped
C:\WINDOWS2\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS2\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS2\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS2\system32\config\default Object is locked skipped
C:\WINDOWS2\system32\config\default.LOG Object is locked skipped
C:\WINDOWS2\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS2\system32\config\SAM Object is locked skipped
C:\WINDOWS2\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS2\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS2\system32\config\SECURITY Object is locked skipped
C:\WINDOWS2\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS2\system32\config\software Object is locked skipped
C:\WINDOWS2\system32\config\software.LOG Object is locked skipped
C:\WINDOWS2\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS2\system32\config\system Object is locked skipped
C:\WINDOWS2\system32\config\system.LOG Object is locked skipped
C:\WINDOWS2\system32\h323log.txt Object is locked skipped
C:\WINDOWS2\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS2\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS2\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS2\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS2\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS2\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS2\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS2\system32\Αdobe\аti2evxx.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\WINDOWS2\wiadebug.log Object is locked skipped
C:\WINDOWS2\wiaservc.log Object is locked skipped
C:\WINDOWS2\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe/data0011/SaveNow.exe Infected: not-a-virus:AdWare.Win32.SaveNow.av skipped
D:\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe/data0011/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.au skipped
D:\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe/data0011 Infected: not-a-virus:AdWare.Win32.SaveNow.au skipped
D:\UTILITATS I DESCÀRREGUES\edicions de video\subtitols\RadLightSubtitleStudio_20r1.exe Inno: infected - 3 skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

Blade81

2007-09-10, 22:23

Hi

1. Download this file -
combofix.exe (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your
next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause
it to stall

tashi

2007-09-18, 21:58

Due to lack of a response to your helper, this topic has been archived.

If you need it re-opened please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.