Need help deleting core.cache.dsk [Archive]

View Full Version : Need help deleting core.cache.dsk

amans123

2008-01-29, 23:25

I got a virus about a week ago on my machine. My AVG and SpyBot were running crazy finding stuff. I thought I got everything removed, but I am still getting these freakin pop-ups. Some say "Powered by Zedo", and others are random. I did some research and found something called core.cache.dsk. I see alot of others on this forum had this problem. I have that file on my machine, it comes back everytime I reboot, when I delete. Please help. I am running the Kaspersky Online Scanner now.....as soon as it is done I will post the log. My HJT Log is pasted below:

Logfile of HijackThis v1.99.1
Scan saved at 3:17 PM, on 01/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Office Gemini\Dokmee Enterprise\Dokmee Import Service.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\Grisoft\AVG7\avginet.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.officegemini.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: NaturaReader - {BCBF738C-4891-4B9A-959A-C6BF7F608C3A} - C:\Program Files\Naturalsoft\NaturalReader66\NVRIEBar.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [CANON DR2080C SVC] rundll32.exe DR2KSVC.dll,EntryPointUserMessage
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O16 - DPF: {40F8967E-34A6-474A-837A-CEC1E7DAC54C} - https://accounting.quickbooks.com/c6/v15.585/qboax9.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1153169933859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1154451450277
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c1/v18.149/qboax10.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA25EE3A-530B-4494-AA8A-AA52557E37B6} (LinkedIn Signature Control) - http://www.linkedin.com/cab/LinkedInSignatureControl.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - https://publishers.esellerate.net/SalesMgr/CustomLayouts/XUpload.ocx
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = OG.loc
O17 - HKLM\Software\..\Telephony: DomainName = OG.loc
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = OG.loc
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = OG.loc
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dokmee Import Service - Unknown owner - C:\Program Files\Office Gemini\Dokmee Enterprise\Dokmee Import Service.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc. - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

amans123

2008-01-30, 16:00

I am a novice , and really need help with this.

amans123

2008-01-30, 17:21

I ran ComboFix...here is the log:

ComboFix 08-01-30.6 - asundara 2008-01-30 8:53:11.2 - NTFSx86
Running from: C:\Documents and Settings\asundara.OG\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\temp\tn3
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
.
---- Previous Run -------
.
C:\Documents and Settings\amandas.ANASYOR\g2mdlhlpx.exe
C:\Documents and Settings\asundara.OG\g2mdlhlpx.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\khfdaax.dll
C:\WINDOWS\system32\kmllm.ini
C:\WINDOWS\system32\kmllm.ini2
C:\WINDOWS\system32\pac.txt

----- BITS: Possible infected sites -----

hxxp://gpdl.google.com
.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-30 )))))))))))))))))))))))))))))))
.

2008-01-30 09:07 . 2008-01-30 09:07 <DIR> d-------- C:\Temp\tn3
2008-01-30 09:02 . 2008-01-30 09:02 1,024 --a------ C:\WINDOWS\system32\drivers\29A30304-B3AF-41B8-A5A6-E0EC6F9A6F7B.cxv
2008-01-30 07:43 . 2008-01-30 07:53 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-01-29 14:42 . 2008-01-29 14:42 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-29 14:42 . 2008-01-29 14:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-29 13:59 . 2008-01-29 14:38 <DIR> d-------- C:\Program Files\XoftSpySE
2008-01-29 13:21 . 2008-01-29 13:21 167,545 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-29 11:56 . 2008-01-29 11:56 <DIR> d-------- C:\Documents and Settings\asundara.OG\Application Data\Grisoft
2008-01-29 11:56 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-29 11:49 . 2008-01-29 14:33 <DIR> d-------- C:\Program Files\a-squared Anti-Malware
2008-01-29 11:43 . 2008-01-29 11:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-28 16:20 . 2008-01-30 09:05 1,392,416 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-28 16:20 . 2008-01-30 09:05 54,560 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-28 16:20 . 2008-01-30 09:05 19,724 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-28 16:20 . 2008-01-30 09:05 8,276 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-28 16:16 . 2008-01-28 16:16 <DIR> d-------- C:\KAV
2008-01-28 16:09 . 2008-01-29 14:35 <DIR> d-------- C:\Program Files\Opera
2008-01-28 12:44 . 2008-01-28 12:44 3,072 --a------ C:\WINDOWS\system32\drivers\D6725CCF-151C-41A1-9965-30B10C058E80.cxv
2008-01-28 10:15 . 2008-01-28 10:35 <DIR> d-------- C:\Program Files\STOPzilla!
2008-01-28 10:15 . 2008-01-28 10:15 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-28 10:15 . 2008-01-30 09:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-28 09:44 . 2007-10-04 17:10 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-28 09:44 . 2007-10-04 17:10 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-28 09:44 . 2007-10-04 17:10 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-28 09:44 . 2007-10-04 17:11 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-01-28 09:43 . 2008-01-28 10:23 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-01-28 09:43 . 2008-01-28 09:43 <DIR> d-------- C:\Documents and Settings\asundara.OG\Application Data\PC Tools
2008-01-28 09:43 . 2008-01-29 11:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-28 09:43 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-01-23 15:15 . 2008-01-23 15:15 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\AVG7
2008-01-23 14:55 . 2005-12-13 01:40 135,168 --a------ C:\WINDOWS\system32\igfxres.dll
2008-01-23 14:40 . 2004-08-04 04:00 482,304 --a--c--- C:\WINDOWS\system32\dllcache\pintlgnt.ime
2008-01-23 14:39 . 2004-08-04 04:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-01-23 14:38 . 2004-08-04 04:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-01-23 14:37 . 2004-08-04 04:00 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-01-23 14:33 . 2008-01-23 14:33 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-01-23 14:33 . 2008-01-23 14:33 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-01-23 14:33 . 2008-01-23 14:33 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-01-23 14:33 . 2008-01-23 14:33 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-01-23 14:33 . 2008-01-23 14:33 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-01-23 14:33 . 2008-01-23 14:33 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-01-23 14:32 . 2004-08-04 04:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe
2008-01-23 14:29 . 2004-08-04 04:00 7,680 --a--c--- C:\WINDOWS\system32\dllcache\inetmgr.exe
2008-01-23 13:42 . 2004-08-04 04:00 1,086,058 -ra------ C:\WINDOWS\SET116.tmp
2008-01-23 13:42 . 2004-08-04 04:00 1,042,903 -ra------ C:\WINDOWS\SET113.tmp
2008-01-23 13:23 . 2008-01-23 13:23 244 --ah----- C:\sqmnoopt07.sqm
2008-01-23 13:23 . 2008-01-23 13:23 244 --ah----- C:\sqmdata07.sqm
2008-01-23 13:07 . 2007-08-27 11:12 2,777,088 --a------ C:\WINDOWS\system32\NETw4r32.dll
2008-01-23 13:07 . 2007-09-26 06:01 2,236,032 --a------ C:\WINDOWS\system32\drivers\NETw4x32.sys
2008-01-23 13:07 . 2007-08-27 11:12 745,472 --a------ C:\WINDOWS\system32\NETw4c32.dll
2008-01-23 12:12 . 2008-01-23 12:12 244 --ah----- C:\sqmnoopt06.sqm
2008-01-23 12:12 . 2008-01-23 12:12 244 --ah----- C:\sqmdata06.sqm
2008-01-23 11:47 . 2008-01-30 07:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-23 10:43 . 2008-01-23 10:43 <DIR> d-------- C:\Program Files\CCleaner
2008-01-23 09:36 . 2008-01-23 09:36 256 --ah----- C:\sqmdata05.sqm
2008-01-23 09:36 . 2008-01-23 09:36 244 --ah----- C:\sqmnoopt05.sqm
2008-01-23 09:12 . 2008-01-23 09:12 256 --ah----- C:\sqmdata04.sqm
2008-01-23 09:12 . 2008-01-23 09:12 244 --ah----- C:\sqmnoopt04.sqm
2008-01-22 15:21 . 2008-01-22 15:21 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-22 15:21 . 2008-01-30 09:11 <DIR> d-------- C:\Documents and Settings\asundara.OG\Application Data\AVG7
2008-01-22 15:20 . 2008-01-22 15:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-22 15:03 . 2008-01-24 10:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-22 14:55 . 2008-01-22 14:55 <DIR> d-------- C:\Program Files\MSN Messenger
2008-01-22 12:38 . 2008-01-22 12:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Ipswitch
2008-01-22 11:57 . 2008-01-22 11:57 <DIR> d-------- C:\Program Files\Alwil Software
2008-01-22 11:41 . 2008-01-22 14:42 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-01-22 11:31 . 2008-01-28 10:45 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-21 16:12 . 2008-01-22 10:47 <DIR> d-------- C:\WINDOWS\system32\winzs6
2008-01-21 16:12 . 2008-01-22 10:47 <DIR> d-------- C:\WINDOWS\system32\nui4
2008-01-21 16:12 . 2008-01-21 16:12 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-21 16:12 . 2008-01-21 16:12 <DIR> d-------- C:\WINDOWS\system32\extz1
2008-01-21 16:12 . 2008-01-22 09:08 <DIR> d-------- C:\WINDOWS\system32\comz7
2008-01-21 16:12 . 2008-01-21 16:12 <DIR> d-------- C:\Temp\gTiis19
2008-01-21 16:12 . 2008-01-21 16:12 <DIR> d-------- C:\Temp\cXzz9
2008-01-21 16:12 . 2008-01-21 16:12 86,016 --a------ C:\WINDOWS\system32\drivers\processrr.sys
2008-01-18 14:31 . 2008-01-18 14:31 <DIR> d-------- C:\Temp\Downloads
2008-01-16 16:04 . 2008-01-16 16:05 <DIR> d-------- C:\Temp\OCR
2008-01-16 16:04 . 2008-01-17 10:09 <DIR> d-------- C:\Temp\Decrypt
2008-01-15 10:47 . 2008-01-30 07:47 <DIR> d-------- C:\Temp\Advance Virtual Directory Name
2008-01-08 10:07 . 2008-01-29 14:35 <DIR> d-------- C:\Program Files\Icon Constructor 3
2008-01-08 10:07 . 2008-01-08 10:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Icon Constructor 3
2008-01-04 14:21 . 2008-01-15 10:44 <DIR> d-------- C:\Temp\Basic Virtual Directory Name
2007-12-21 11:36 . 2008-01-29 10:41 <DIR> d-------- C:\Temp\Orgfiles
2007-12-21 11:36 . 2007-12-21 11:36 <DIR> d-------- C:\Temp\Inner Temp
2007-12-21 11:36 . 2007-12-21 11:36 <DIR> d-------- C:\Temp\Files
2007-12-21 11:36 . 2007-12-21 11:36 <DIR> d-------- C:\Temp\AnnoFiles
2007-12-21 11:36 . 2008-01-30 09:07 <DIR> d-------- C:\Temp
2007-12-11 15:36 . 2008-01-22 10:34 <DIR> d-------- C:\Program Files\Boldchat
2007-12-11 14:09 . 2007-12-11 14:09 <DIR> d-------- C:\Program Files\TTS1.4
2007-12-03 15:37 . 2007-12-03 15:37 <DIR> d-------- C:\RISPtemp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 15:03 --------- d-----w C:\Documents and Settings\asundara.OG\Application Data\Skype
2008-01-29 20:34 --------- d-----w C:\Program Files\Google
2008-01-29 20:33 --------- d-----w C:\Documents and Settings\amandas.ANASYOR\Application Data\Lavasoft
2008-01-25 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-24 21:58 --------- d-----w C:\Program Files\ScanSoft
2008-01-24 16:04 --------- d-----w C:\Program Files\GameSpy Arcade
2008-01-23 17:09 --------- d-----w C:\Documents and Settings\asundara.OG\Application Data\U3
2008-01-22 21:06 --------- d-----w C:\Program Files\Common Files\Business Objects
2008-01-22 17:14 --------- d-----w C:\Program Files\Citrix
2008-01-22 15:08 --------- d-----w C:\Program Files\QuickTime
2008-01-22 15:08 --------- d-----w C:\Program Files\MediaFaceOnlinePluginsService
2008-01-18 16:38 --------- d-----w C:\Program Files\Office Gemini
2007-12-10 20:10 --------- d-----w C:\Program Files\NaturalSoft
2007-11-29 16:48 --------- d-----w C:\Program Files\True BoxShot
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31 22880040]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CANON DR2080C SVC"="DR2KSVC.dll" [2007-03-02 11:40 229376 C:\WINDOWS\system32\DR2KSVC.dll]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-23 15:15 579072]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-12-13 01:44 98304]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-12-13 01:41 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-12-13 01:45 118784]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 10:48 761947]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 15:30 282624 C:\WINDOWS\stsystra.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 15:15 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IETI"="C:\Program Files\Skype\Phone\IEPlugin\unins000.exe" [ ]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 04:00 44544]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-BA7E-100000000002}\SC_Acrobat.exe [2007-02-26 10:44:05 25214]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-03 08:39:59 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 00:48:20 40048]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 23:01:50 734872]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-07-08 01:21:42 24576]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-01-28 09:43:28 124400]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-02-02 15:16:40 663552]
TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2007-05-08 12:18:00 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\0]
"Script"=O_MS7Shell.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\1]
"Script"=R_MSDCSch.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\2]
"Script"=S_Software.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\3]
"Script"=T_EGL.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\4]
"Script"=U_ProductionData.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\5]
"Script"=V_MS7DVcentral.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\6]
"Script"=W_Ftp.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\7]
"Script"=X_Ms5Database .vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\8]
"Script"=Y_Ms4DatabaseBack.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-909454431-2058629155-227697207-1128\Scripts\Logon\0\9]
"Script"=Z_AscentReleased.vbs

R1 processrr;processrr;C:\WINDOWS\system32\drivers\processrr.sys [2008-01-21 16:12]
R2 Dokmee Import Service;Dokmee Import Service;"C:\Program Files\Office Gemini\Dokmee Enterprise\Dokmee Import Service.exe" [2008-01-28 09:51]
R2 OneTouch 4.0 Monitor;OneTouch 4.0 Monitor;"C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe" [2006-06-12 17:04]
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-04 04:00]
R3 tenCapture;tenCapture;C:\WINDOWS\system32\DRIVERS\tenCapture.sys [2007-04-21 08:15]
S3 HHPCDC;HHPCDC;C:\WINDOWS\system32\drivers\hhpcdc.sys [2007-03-01 16:21]
S3 PCTINDIS5;PCTINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\PCTINDIS5.SYS [2007-06-14 12:59]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys []
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2006-04-14 09:04]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" [2005-09-23 06:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe03aa4a-6522-11dc-a2be-0015c562cdd3}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-30 09:09:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Office Gemini\Dokmee Enterprise\Dokmee Import Service.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
.
**************************************************************************
.
Completion time: 2008-01-30 9:17:52 - machine was rebooted [asundara]
ComboFix-quarantined-files.txt 2008-01-30 15:17:47
.
2008-01-29 22:16:56 --- E O F ---

amans123

2008-01-30, 19:31

I ran Kespersky if that helps.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
2008-01-30 11:29
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 30/01/2008
Kaspersky Anti-Virus database records: 538096
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 127073
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:59:09

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_50e417e0-e461-474b-96e2-077b80325612 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped
C:\Documents and Settings\All Users\Application Data\STOPzilla!\targets.db Object is locked skipped
C:\Documents and Settings\All Users\Application Data\STOPzilla!\userdata.db Object is locked skipped
C:\Documents and Settings\All Users\Application Data\STOPzilla!\zilla5.log Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Microsoft\Outlook\Outlook.NK2 Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Microsoft\Outlook\Outlook~1.srs Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Microsoft\Word\~WRA0002.wbk Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\call256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\callmember256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chat1024.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chat256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chat512.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chatmember256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chatmsg1024.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chatmsg2048.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chatmsg256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chatmsg512.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chatmsg8192.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\chatsync\0d\0dd926b765f21f5e.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\contactgroup256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\dyncontent\bundle.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\index2.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\profile4096.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\transfer256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\transfer512.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\user1024.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\user16384.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\user4096.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Application Data\Skype\royalimaging_as\voicemail256.dbb Object is locked skipped
C:\Documents and Settings\asundara.OG\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Messenger\KamaKrazy83@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Messenger\KamaKrazy83@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Messenger\KamaKrazy83@hotmail.com\SharingMetadata\Working\database_DCF0_20F5_F020_D792\dfsr.db Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Messenger\KamaKrazy83@hotmail.com\SharingMetadata\Working\database_DCF0_20F5_F020_D792\fsr.log Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Messenger\KamaKrazy83@hotmail.com\SharingMetadata\Working\database_DCF0_20F5_F020_D792\fsrtmp.log Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Messenger\KamaKrazy83@hotmail.com\SharingMetadata\Working\database_DCF0_20F5_F020_D792\tmp.edb Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Windows Live Contacts\KamaKrazy83@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\Microsoft\Windows Live Contacts\KamaKrazy83@hotmail.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Application Data\SITEguard\siteguard.db Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DF3F3C.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DF87FD.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DF8DDD.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DF8E2A.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DF9FAF.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DFA07E.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DFCB93.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~DFCBB2.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~WRF0003.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temp\~WRS0005.tmp Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\asundara.OG\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\asundara.OG\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\OGDokmee.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\OGDokmee_log.ldf Object is locked skipped
C:\Program Files\YouSendIt\YouSendIt Outlook Add-in\log.txt Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP22\A0001807.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP22\A0001808.exe Object is locked skipped
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP36\change.log Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{C8921041-0756-4AA9-A1E7-8BBD1BAA8786}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Quick Li.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\drivers\processrr.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

amans123

2008-01-30, 23:13

Well......since this is my work computer, I need it fixed ASAP. I am going to re-install my operating system and programs tonight if I do not get some replies non how to fix this soon.

TIA for your help.

pskelley

2008-01-31, 17:46

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Appears you have not taken the time to read the directions posted at the top of this forum.

since this is my work computer
Personal computers or.....

Note: When the infected computer in question is a company machine in the workplace, and you are an employee.
Your organization must give their permission for assistance to be received in the removal of malware. The intention of this forum is not to replace a company's IT department.
More than one machine could be at stake, possibly even the server. If sensitive material has been compromised by an infection, the company could be held liable.
Please inform your IT department or Supervisor when a workplace computer has been infected, immediately.
Thank you for your understanding.

pskelley

2008-02-07, 12:48

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.

Everyone else please begin a New Topic.