please help me with virtumonde and smitfreud...

[ozgur1318]

i installed Spybot 1.5 . it detected some of the spywares and thinks he erased them .i also did it in the safe mode...
but online kaspersky found some items infected.. ok
here are my logs... thank u...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:51, on 02.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\PROGRA~1\KURYAZ~1\SAYISA~1\Saat.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.altavista.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll (file missing)
O4 - HKLM\..\Run: [Alarmli Sayisal Saat 2.11] C:\PROGRA~1\KURYAZ~1\SAYISA~1\Saat.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z Toolbar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} (Java Plug-in 1.4.2_05) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: CLKERN.DLL,C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - http://myspace-674.vo.llnwd.net/00508/47/63/508113674_l.jpg

--
End of file - 8052 bytes
-----------------------------------------

[ozgur1318]

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, November 02, 2007 10:17:12 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/11/2007
Kaspersky Anti-Virus database records: 450025
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 94661
Number of viruses found: 5
Number of infected objects: 14
Number of suspicious objects: 0
Duration of the scan process: 01:38:32

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Lavasoft\Ad-Aware\Logs\AWEVLOG.txt Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\indexer\indexer_64.dat Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\store\account1\2006-02.mbs Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\store\account1\2007\06\15\4.mbs Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\store\account1\2007\06\15\5.mbs Object is locked skipped
C:\Documents and Settings\ASUS\Application Data\Opera\Opera\mail\store\account1\2007-02.mbs Object is locked skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip/Overnet 0.50.1 + Upload-Banner Crack (no spyware).zip/Overnet 0.50.1 + Upload-Banner Crack/overnet0.50.1.exe/data0004/fatovernet.exe Infected: not-a-virus:Server-Proxy.Win32.Overnet skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip/Overnet 0.50.1 + Upload-Banner Crack (no spyware).zip/Overnet 0.50.1 + Upload-Banner Crack/overnet0.50.1.exe/data0004 Infected: not-a-virus:Server-Proxy.Win32.Overnet skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip/Overnet 0.50.1 + Upload-Banner Crack (no spyware).zip/Overnet 0.50.1 + Upload-Banner Crack/overnet0.50.1.exe/data0014/UCMIE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore.a skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip/Overnet 0.50.1 + Upload-Banner Crack (no spyware).zip/Overnet 0.50.1 + Upload-Banner Crack/overnet0.50.1.exe/data0014/IUCMORE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip/Overnet 0.50.1 + Upload-Banner Crack (no spyware).zip/Overnet 0.50.1 + Upload-Banner Crack/overnet0.50.1.exe/data0014 Infected: not-a-virus:AdWare.Win32.Ucmore skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip/Overnet 0.50.1 + Upload-Banner Crack (no spyware).zip/Overnet 0.50.1 + Upload-Banner Crack/overnet0.50.1.exe Infected: not-a-virus:AdWare.Win32.Ucmore skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip/Overnet 0.50.1 + Upload-Banner Crack (no spyware).zip Infected: not-a-virus:AdWare.Win32.Ucmore skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down musıc\Fazılsal\all the greatest p2p progs in 1! (including kazaa gold, imesh, dc++, shareaza, emule and much more!).zip ZIP: infected - 7 skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down Programs\some programs\BearShareV6int.exe/WISE0045.BIN/stream/data0005 Infected: not-a-virus:AdWare.Win32.Mostofate.aa skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down Programs\some programs\BearShareV6int.exe/WISE0045.BIN/stream Infected: not-a-virus:AdWare.Win32.Mostofate.aa skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down Programs\some programs\BearShareV6int.exe/WISE0045.BIN Infected: not-a-virus:AdWare.Win32.Mostofate.aa skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down Programs\some programs\BearShareV6int.exe WiseSFX: infected - 3 skipped
C:\Documents and Settings\ASUS\Belgelerim\downloads\Down Programs\some programs\BearShareV6int.exe WiseSFX Dropper: infected - 3 skipped
C:\Documents and Settings\ASUS\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\History\History.IE5\MSHist012007110220071103\index.dat Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Temp\~DF248A.tmp Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Temp\~DF865D.tmp Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Temp\~DFD751.tmp Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\ASUS\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\ASUS\ntuser.dat Object is locked skipped
C:\Documents and Settings\ASUS\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_AGENT_LOG1.txt Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_AUDIO\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_AUDIO\CLML.db-journal Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_BINARY\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_BLOB\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_BLOB\CLML.db-journal Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_GLOBAL\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_GLOBAL\CLML.db-journal Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_IMAGE\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_IMAGE\CLML.db-journal Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_MAIN\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_MAIN\CLML.db-journal Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_TV\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_TV\CLML.db-journal Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_VIDEO\CLML.db Object is locked skipped
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLML_VIDEO\CLML.db-journal Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{07F5AE74-2BB5-4A6E-8AE7-A9A44439AC20}\RP177\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\OZGUR.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{E5F15533-0FBA-445A-B061-BB82582D6D50}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\tusss.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.id skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\ZLT040c1.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT05ae6.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[Blade81]

Hi

Looks quite clean (some false alarms in Kaspersky findings).

Delete following file if found:
C:\WINDOWS\system32\tusss.exe

Looks like there are some parts of Avast left. Have you uninstalled it?

[ozgur1318]

i have some questions. and i still believe i have some spyware (reasons given in 2- ,3-, ).
if u can explain me i'll be very glad...
1- i didnt uninstalled avast yet. but i'll uninstall it soon.
can u give me some tips for cleaning avast from registry if needed after i uninstall it .?
2-it seems like my windows cant update an important update because of a spyware or stg. At least that's what my windows updater says when i try to update and troubleshoot:
"Microsoft .NET Framework Sürüm 1.1 Service Pack 1 Güvenlik Güncelleştirmesi (KB928366)".
when i chcked my update history i noticed that it couldnt be updadated since 11th of july 2007
.....
3-i updated my windows live messanger 1-2 months ago.i installed my windows live messanger latest vesion, again and again.but i can hardly use it because it doesnt open most of the time and when i do all the troubleshootings step by step
mainly it says 2 things
a) check your windows updates
b) the trouble might be caused by a spyware or trojan. etc...

.. thank u for your help..

[Blade81]

1- i didnt uninstalled avast yet. but i'll uninstall it soon.
can u give me some tips for cleaning avast from registry if needed after i uninstall it .?You don't have to uninstall Avast (unless you replace it with some other anti virus product). I just asked 'cos according to log it looked like only updating process was running.


2-it seems like my windows cant update an important update because of a spyware or stg. At least that's what my windows updater says when i try to update and troubleshoot:
"Microsoft .NET Framework Sürüm 1.1 Service Pack 1 Güvenlik Güncelleştirmesi (KB928366)".
when i chcked my update history i noticed that it couldnt be updadated since 11th of july 2007
.....Is that only update you're missing? You can download it from Microsoft's site (http://www.google.fi/url?sa=t&ct=res&cd=1&url=http%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3Ffamilyid%3Da8f5654f-088e-40b2-bbdb-a83353618b38&ei=TfczR-j5Naeu-AL-lZn3Cg&usg=AFQjCNH6dK4f8C4BQ5qh3gPWWf_ij0UDmg&sig2=OfiP7zy2FM55TtQusP9KvA)


3-i updated my windows live messanger 1-2 months ago.i installed my windows live messanger latest vesion, again and again.but i can hardly use it because it doesnt open most of the time and when i do all the troubleshootings step by step
mainly it says 2 things
a) check your windows updates
b) the trouble might be caused by a spyware or trojan. etc...
I don't believe this is malware issue. Have you allowed Messenger access thru Zonealarm firewall?

[ozgur1318]

1-yes because it has expired..it needs license and i dont have any. so i have to uninstall it anyway.. i mean i will replace it with another virüs program because it has expired. so that'swhy i have to uninstall first...
2-yes i tried it many many times .but somehow i can't.because of the spywares.
3-and yes i allowed my firewall to acept msn messanger (windows live messanger)...
thanks...

[Blade81]

I still don't believe malware being behind those 2 & 3. I think you should ask help for them at PCPitstop (http://forums.pcpitstop.com)

[Blade81]

Due to inactivity, this thread will now be closed. If you need this topic reopened, please contact a Staff member. Include the address of this thread in your request. This applies only to the original topic starter. Should you have a new issue, please start a New Topic.