PDA

View Full Version : Please help me remove win32/NSAnti


greengen
2008-02-21, 10:48
hi

couple of days back i inserted a USB storage device in my laptop and AVG AV automatically detected a win32/NSAnti virus in it. i immediately formated the usb disk but my computer is still infected and so is the external disk. I am posting Kaspersky and HJT log. Any help would be highly appreciated.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, February 21, 2008 2:38:38 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 21/02/2008
Kaspersky Anti-Virus database records: 574229
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 16384
Number of viruses found: 5
Number of infected objects: 97
Number of suspicious objects: 0
Duration of the scan process: 00:19:33

Infected Object Name / Virus Name / Last Action
C:\autorun.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped
C:\Documents and Settings\carrera\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\carrera\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\carrera\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\carrera\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\carrera\Local Settings\Temp\l4rq2a7.dll Object is locked skipped
C:\Documents and Settings\carrera\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\carrera\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\carrera\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\gumkrhf.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000065.dll Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000066.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000067.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000088.dll Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000097.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000098.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000118.dll Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000124.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000125.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000133.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000134.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000152.dll Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000157.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000158.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000165.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000166.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000178.dll Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000180.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000181.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000192.dll Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000195.bat Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000196.inf Infected: Worm.Win32.AutoRun.cpq skipped
C:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\amvo.exe Infected: Worm.Win32.AutoRun.cpq skipped
C:\WINDOWS\system32\amvo0.dll Infected: Worm.Win32.AutoRun.cpq skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\autorun.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\gumkrhf.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\software\ipscan.exe Infected: not-a-virus:NetTool.Win32.Portscan.c skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{62C50247-C010-41F8-945D-DD85C68063D9}\RP8\A0000677.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{62C50247-C010-41F8-945D-DD85C68063D9}\RP8\A0000678.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{92832C61-84BC-461C-9244-E75C795DCF86}\RP7\A0000527.exe Object is locked skipped
D:\System Volume Information\_restore{92832C61-84BC-461C-9244-E75C795DCF86}\RP7\A0000528.exe Object is locked skipped
D:\System Volume Information\_restore{92832C61-84BC-461C-9244-E75C795DCF86}\RP7\A0000533.exe Infected: not-a-virus:RemoteAdmin.Win32.RA.51122 skipped
D:\System Volume Information\_restore{92832C61-84BC-461C-9244-E75C795DCF86}\RP7\A0000534.exe Infected: not-a-virus:RemoteAdmin.Win32.RA.2929 skipped
D:\System Volume Information\_restore{92832C61-84BC-461C-9244-E75C795DCF86}\RP7\A0000535.exe Infected: Backdoor.Win32.RA-based.g skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000022.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000023.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000068.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000069.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000099.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000100.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000126.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000127.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000135.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000136.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000159.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000160.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000167.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000168.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000182.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000183.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000197.bat Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000198.inf Infected: Worm.Win32.AutoRun.cpq skipped
D:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\change.log Object is locked skipped
D:\System Volume Information\_restore{FD0C844D-B2FB-47A0-9E4B-00670E2F9C29}\RP45\A0009985.exe Infected: not-a-virus:RemoteAdmin.Win32.RA.51122 skipped
E:\autorun.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\gumkrhf.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{62C50247-C010-41F8-945D-DD85C68063D9}\RP8\A0000679.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{62C50247-C010-41F8-945D-DD85C68063D9}\RP8\A0000680.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000024.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000025.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000070.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000071.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000101.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000102.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000128.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000129.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000137.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000138.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000161.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000162.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000169.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000170.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000184.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000185.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000199.bat Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000200.inf Infected: Worm.Win32.AutoRun.cpq skipped
E:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\change.log Object is locked skipped
F:\autorun.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\gumkrhf.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{62C50247-C010-41F8-945D-DD85C68063D9}\RP8\A0000681.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{62C50247-C010-41F8-945D-DD85C68063D9}\RP8\A0000682.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000026.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000027.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000072.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP1\A0000073.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000103.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000104.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000130.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP2\A0000131.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000139.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000140.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000163.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP3\A0000164.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000171.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000172.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000186.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000187.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000201.bat Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\A0000202.inf Infected: Worm.Win32.AutoRun.cpq skipped
F:\System Volume Information\_restore{C7778E2D-11E5-47EF-9F1A-D97354E515E3}\RP4\change.log Object is locked skipped

Scan process completed.
greengen
2008-02-21, 10:50
here is the HJT log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:42:26 PM, on 2/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

--
End of file - 2803 bytes