PDA

View Full Version : Trojan.WIN32 and Smitfraud


nopressure
2007-12-27, 04:45
Windows Live Onecare and Spybot have both been unable to permanently delete this virus...Any assistance you can provide would be greatly appreciated.



HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:52:39 PM, on 12/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Palm\Hotsync.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB9069] command /c del "C:\WINDOWS\system32\drivers\core.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9988] cmd /c del "C:\WINDOWS\system32\drivers\core.sys"
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6737 bytes
nopressure
2007-12-27, 04:48
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, December 26, 2007 9:39:43 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 26/12/2007
Kaspersky Anti-Virus database records: 495183
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 57850
Number of viruses found: 6
Number of infected objects: 28
Number of suspicious objects: 0
Duration of the scan process: 00:43:18

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{0FF8005C-D109-1D36-E111-26EBA0868F68}-ardCo172314.exe Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{24B19ABF-8648-2FB7-6B91-0AA1CBFC3FE4}-brop22drvr.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{4514DE29-E617-4A8E-F406-599F395A4940}-brop22drvr.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{4E7A2EEE-A82A-E320-5601-E3658B324450}-A0001662.exe/data0006 Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{4E7A2EEE-A82A-E320-5601-E3658B324450}-A0001662.exe NSIS: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{4E7A2EEE-A82A-E320-5601-E3658B324450}-A0001662.exe PE-Crypt.XorPE: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{6A098BF3-4C7A-FA9F-D6E4-40D3FDB33198}-A0001666.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{9C3AA649-D147-121E-6CAE-A11DF712BAD8}-A0001675.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{A486A32C-4826-67AC-FDA2-375503A8055D}-wr-1-1000512.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{A6B29234-5CB7-9582-33A0-4BAFECED276E}-ardCo172314.exe Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{B7895298-EB15-BC65-5E43-9DE2BC00A188}-A0001672.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{C5F1DFCD-5B9D-AE8A-A64B-514C704785D5}-A0001674.exe Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{C712937B-576A-521F-FFA2-3121C419E3FE}-A0001690.exe Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{CB20E8E7-E7D9-8658-DEC3-2D8310C456DA}-2314.exe/data0006 Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{CB20E8E7-E7D9-8658-DEC3-2D8310C456DA}-2314.exe NSIS: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{CB20E8E7-E7D9-8658-DEC3-2D8310C456DA}-2314.exe PE-Crypt.XorPE: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{CB3F9BE3-3F0A-0347-41DE-087AAE3CA56F}-A0001654.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{CFC69C24-9F8D-051E-8536-2D14300765E3}-A0001678.exe/data0006 Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{CFC69C24-9F8D-051E-8536-2D14300765E3}-A0001678.exe NSIS: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{CFC69C24-9F8D-051E-8536-2D14300765E3}-A0001678.exe PE-Crypt.XorPE: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\LocalCopy\{F9039FA5-2640-E676-BDCD-24F979F4D7ED}-A0001688.exe Infected: Trojan-Downloader.Win32.Small.hhp skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\Support\MPLog-12242007-073256.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Protection Service\edb.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Protection Service\edbtmp.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Protection Service\MPSSVCPolicyIdLog.etl Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Microsoft\Word\AutoRecovery save of Normal.as$ Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\cert8.db Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\history.dat Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\key3.db Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\parent.lock Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Glenn\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0dc0-249b1d3e.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\Glenn\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0dc0-249b1d3e.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Glenn\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Glenn\Desktop\Spybot - steps before you post.doc Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Application Data\Mozilla\Firefox\Profiles\hekckqb5.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\Spybot - steps before you post.doc Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\Tear.exe Infected: Trojan-Downloader.Win32.Agent.gvh skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\~DF3813.tmp Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\~DF7153.tmp Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\~DF810A.tmp Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\~DFA3FD.tmp Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\~DFFAE8.tmp Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temp\~WRS0002.tmp Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Glenn\Local Settings\Temporary Internet Files\silverstar.exe Infected: Trojan.Win32.Pakes.bvr skipped
C:\Documents and Settings\Glenn\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Glenn\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\i386\axebmbrpl6.exe Infected: Trojan.Win32.Pakes.bvs skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Ent.dat Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\prov.xml Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml.bak Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml.bak Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\ClientSD\SubInfo.xml Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\Database\edb.log Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\Database\tmp.edb Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\onecaremp_log.bin Object is locked skipped
C:\Program Files\Microsoft Windows OneCare Live\WinSSSvc_log.bin Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP26\A0001659.exe Infected: Trojan.Win32.Pakes.bvr skipped
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP29\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{36D8D3EE-59B4-4936-B594-98BB8172B90C}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped
C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\MSFWSVC.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\Windows_OneCare_Evt.evt Object is locked skipped
C:\WINDOWS\system32\dj2\axebmbrpl6.exe Infected: Trojan.Win32.Pakes.bvs skipped
C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
C:\WINDOWS\system32\drivers\core.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_884.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.