Probabbly SMithfraud

[kkoray]

C drive vista d drive windows xp

Process List:

1) Kaspersky Online Scanner WEbsite 9:10pm 3/3/2008
2) Kaspersky Online Scanner Finish downloading The definitions 9:20pm 3/3/2008
3) Kaspersky Online Scanner Start Scanning ( Extedended ) 9:21pm 3/3/2008
4) Kaspersky online scanner duration of the scan is 9:23 hours Completed 6:47Am 3/4/2008
5) WIndows xp safe mode 6:56am 3/4/2008
6) Spybot Search & Destroy Start scanning 6:57am 3/4/2008
7) Spybot Findings: Smitfraud-C.CoreService d:\windows\system32\drivers\core.cache.dsk (Spybot can remove the file in safemod but it comes back. My findings are it comes back when I open IE or Firefox not %100 sure.I just don't get pop ups until I open a browser. ( I run ( Smithfraud remover tool in safe mode selections 1 and 2 before didn't help. didn't find the smithfraud weird.)
8) Spybot Finishes it is search with 9 findings. 7:40am 3/4/2008 8:29AM
9) Install hijacthis save the log gile and submit to the forum 8:40am

Kaspersky Log:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, March 04, 2008 6:48:20 AM
Operating System: Microsoft Windows XP Professional, Service Pack 3, v.3311 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/03/2008
Kaspersky Anti-Virus database records: 594923
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
H:\

Scan Statistics:
Total number of scanned objects: 178118
Number of viruses found: 30
Number of infected objects: 225
Number of suspicious objects: 0
Duration of the scan process: 09:23:01

Infected Object Name / Virus Name / Last Action
C:\hiberfil.sys Object is locked skipped
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_1ff3886a-e

b8d-4935-8f32-09f0cba43eba Object is locked skipped
C:\ProgramData\Nero\Nero8\OnlineServices\usagestats.bin Object is locked skipped
C:\ProgramData\Symantec\SRTSP\SrtETmp\C6A2661C.TMP Object is locked skipped
C:\ProgramData\Symantec\SRTSP\SrtETmp\D17273D7.TMP Object is locked skipped
C:\ProgramData\Symantec\Symantec AntiVirus Corporate

Edition\7.5\Quarantine\0BCC0001\4FFF8018.VBN Object is locked skipped
C:\ProgramData\Symantec\Symantec AntiVirus Corporate

Edition\7.5\Quarantine\0BCC0003\4FFF8238.VBN Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked

skipped
C:\System Volume Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP67\change.log

Object is locked skipped
C:\Users\KORAY\AppData\Local\Temp\Ahead Nero Burning ROM Ultra edition

8.2.8.0.rar/keygen.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.dux skipped
C:\Users\KORAY\AppData\Local\Temp\Ahead Nero Burning ROM Ultra edition

8.2.8.0.rar/crack.exe Infected: Trojan.Win32.Dialer.yz skipped
C:\Users\KORAY\AppData\Local\Temp\Ahead Nero Burning ROM Ultra edition 8.2.8.0.rar

RAR: infected - 2 skipped
C:\Users\KORAY\AppData\Local\Temp\NERO14399\Toolbar.exe Infected:

not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Users\KORAY\AppData\Roaming\Nero\Nero8\OnlineServices\registrationinfo.xml Object is

locked skipped
C:\Users\KORAY\AppData\Roaming\VMware\featuredvm.ini Object is locked skipped
C:\Users\KORAY\AppData\Roaming\VMware\featuredvm.png Object is locked skipped
C:\Windows\CSC\v2.0.6\pq Object is locked skipped
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Object is locked

skipped
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl Object is locked

skipped
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl Object is locked

skipped
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl Object is locked

skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

Object is locked skipped
D:\Documents and Settings\Koray\Application Data\BitDefender\Desktop\Profiles\asdict.dat

Object is locked skipped
D:\Documents and Settings\Koray\Cookies\index.dat Object is locked skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/IECacheView.exe Infected: not-a-virus:PSWTool.Win32.NetPass.h

skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/iepv.exe Infected: not-a-virus:PSWTool.Win32.IEPassView.a

skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/mailpv.exe Infected:

not-a-virus:PSWTool.Win32.MailPassView.130 skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/mspass.exe Infected: not-a-virus:PSWTool.Win32.Messen.m

skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/netpass.exe Infected: not-a-virus:PSWTool.Win32.NetPass.b

skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/ProduKey.exe Infected: not-a-virus:PSWTool.Win32.ProductKey.e

skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/pspv.exe Infected: not-a-virus:PSWTool.Win32.PassView.b skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/PstPassword.exe Infected: not-a-virus:PSWTool.Win32.MailPassView.a

skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar/USB Thief New stuff

added/USB Thief/batexe/VideoCacheView.exe Infected:

not-a-virus:PSWTool.Win32.NetPass.l skipped
D:\Documents and Settings\Koray\Desktop\USB_Thief_New_stuff_added.rar RAR: infected - 9

skipped
D:\Documents and Settings\Koray\Local Settings\Application

Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
D:\Documents and Settings\Koray\Local Settings\Application

Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
D:\Documents and Settings\Koray\Local Settings\History\History.IE5\index.dat Object is

locked skipped
D:\Documents and Settings\Koray\Local Settings\Temp\~DFC116.tmp Object is locked

skipped
D:\Documents and Settings\Koray\Local Settings\Temporary Internet

Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked

skipped
D:\Documents and Settings\Koray\Local Settings\Temporary Internet

Files\Content.IE5\index.dat Object is locked skipped
D:\Documents and Settings\Koray\ntuser.dat Object is locked skipped
D:\Documents and Settings\Koray\ntuser.dat.LOG Object is locked skipped
D:\Documents and Settings\LocalService\Cookies\index.dat Object is locked

skipped
D:\Documents and Settings\LocalService\Local Settings\Application

Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
D:\Documents and Settings\LocalService\Local Settings\Application

Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
D:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat

Object is locked skipped
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet

Files\Content.IE5\index.dat Object is locked skipped
D:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
D:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
D:\Documents and Settings\NetworkService\Local Settings\Application

Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
D:\Documents and Settings\NetworkService\Local Settings\Application

Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
D:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
D:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
D:\Program Files\BitDefender\BitDefender 2008\as2core\antispam_sig\aspdict.dat Object is

locked skipped
D:\Program Files\BitDefender\BitDefender 2008\dbokf.db Object is locked skipped
D:\Program Files\BitDefender\BitDefender 2008\dbokf.db-journal Object is locked

skipped
D:\Program Files\Mozilla Firefox\SmitfraudFix\Reboot.exe Infected:

not-a-virus:RiskTool.Win32.Reboot.f skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked

skipped
D:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0019124.exe/data.rar/Smitf

raudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
D:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0019124.exe/data.rar

Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
D:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0019124.exe RarSFX:

infected - 2 skipped
D:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0019125.exe/data.rar/Smitf

raudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
D:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0019125.exe/data.rar

Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
D:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0019125.exe RarSFX:

infected - 2 skipped
D:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0019134.exe Infected:

not-a-virus:RiskTool.Win32.Reboot.f skipped
D:\System Volume Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP67\change.log

Object is locked skipped
D:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
D:\WINDOWS\SchedLgU.Txt Object is locked skipped
D:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
D:\WINDOWS\Sti_Trace.log Object is locked skipped
D:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
D:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
D:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
D:\WINDOWS\system32\config\default Object is locked skipped
D:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped
D:\WINDOWS\system32\config\Internet.evt Object is locked skipped
D:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
D:\WINDOWS\system32\config\OSession.evt Object is locked skipped
D:\WINDOWS\system32\config\SAM Object is locked skipped
D:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
D:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
D:\WINDOWS\system32\config\SECURITY Object is locked skipped
D:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
D:\WINDOWS\system32\config\software Object is locked skipped
D:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped
D:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
D:\WINDOWS\system32\config\system Object is locked skipped
D:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped
D:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
D:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
D:\WINDOWS\system32\drivers\usbintell.sys Object is locked skipped
D:\WINDOWS\system32\h323log.txt Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
D:\WINDOWS\Temp\tmp00001606\tmp00000000 Object is locked skipped
D:\WINDOWS\wiadebug.log Object is locked skipped
D:\WINDOWS\wiaservc.log Object is locked skipped
D:\WINDOWS\WindowsUpdate.log Object is locked skipped

I removed the information for H drive.... to long...
H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked

skipped
H:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0018902.exe/data0000.cab/u

pdate.exe Infected: Trojan.Win32.Agent.efb skipped
H:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0018902.exe/data0000.cab

Infected: Trojan.Win32.Agent.efb skipped
H:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP60\A0018902.exe

Rsrc-Package: infected - 2 skipped
H:\System Volume

Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP67\A0025268.EXE Object is

locked skipped
H:\System Volume Information\_restore{4F6DD665-CC0E-4880-887D-F557E34BF2BE}\RP67\change.log

Object is locked skipped



HIjackthis LOG:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:38:01 AM, on 3/4/2008
Platform: Windows XP SP3, v.3311 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Google\Google Updater\GoogleUpdater.exe
D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
D:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
D:\Program Files\Belkin\Nostromo\nost_LM.exe
D:\Program Files\Logitech\SetPoint II\SetpointII.exe
D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
D:\WINDOWS\system32\HPZipm12.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
D:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
D:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - D:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "D:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "D:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = D:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Nostromo Loadout Manager.lnk = ?
O4 - Global Startup: SetPointII.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A1E435DD-82EF-457D-9A37-9306A1EDAFDD}: NameServer = 192.168.2.1
O20 - AppInit_DLLs: D:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Desktop Manager 5.7.801.1629 (GoogleDesktopManager-010108-205858) - Google - D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - D:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - D:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - D:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - D:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 6351 bytes

[kkoray]

I install kaspersky internet security 7 last version and I won't get up pop ups anymore. I will give another Hijack Report and Kaspersky Report tommorrow you guys can check if there is anything left..