Page 1 of 3 123 LastLast
Results 1 to 10 of 25

Thread: bad start on last log can we try again please?

  1. 2008-07-27, 03:00 #1
    justime8
    justime8 is offline
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default bad start on last log can we try again please?

    had family emergency sorry I was not able to follow up with my last post i will be sure to follow this one!
    here is my hjt log(a new one)
    6/24/2008 9:18:45 AM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    6/24/2008 9:19:30 AM downloaded update Detection rules: Dialers
    6/24/2008 9:19:30 AM - URL: http://www.spybotupdates.biz/updates...des.dialer.zip
    6/24/2008 9:19:30 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.dialer.zip
    6/24/2008 9:19:40 AM downloaded update Detection rules: Hijackers
    6/24/2008 9:19:40 AM - URL: http://www.spybotupdates.biz/updates....hijackers.zip
    6/24/2008 9:19:40 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.hijackers.zip
    6/24/2008 9:19:44 AM downloaded update Detection rules: Keyloggers
    6/24/2008 9:19:44 AM - URL: http://www.spybotupdates.biz/updates...keyloggers.zip
    6/24/2008 9:19:44 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.keyloggers.zip
    6/24/2008 9:20:09 AM downloaded update Detection rules: Malware
    6/24/2008 9:20:09 AM - URL: http://www.spybotupdates.biz/updates...es.malware.zip
    6/24/2008 9:20:09 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.malware.zip
    6/24/2008 9:20:15 AM downloaded update Detection rules: PUPS
    6/24/2008 9:20:15 AM - URL: http://www.spybotupdates.biz/updates...ludes.pups.zip
    6/24/2008 9:20:15 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.pups.zip
    6/24/2008 9:20:16 AM downloaded update Detection rules: Security
    6/24/2008 9:20:16 AM - URL: http://www.spybotupdates.biz/updates...s.security.zip
    6/24/2008 9:20:16 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.security.zip
    6/24/2008 9:20:27 AM downloaded update Detection rules: Spybots
    6/24/2008 9:20:27 AM - URL: http://www.spybotupdates.biz/updates...es.spybots.zip
    6/24/2008 9:20:27 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.spybots.zip
    6/24/2008 9:21:02 AM downloaded update Detection rules: Supplemental
    6/24/2008 9:21:02 AM - URL: http://www.spybotupdates.biz/updates...pplemental.zip
    6/24/2008 9:21:02 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\supplemental.zip
    6/24/2008 9:21:34 AM downloaded update Detection rules: Trojans
    6/24/2008 9:21:34 AM - URL: http://www.spybotupdates.biz/updates...es.trojans.zip
    6/24/2008 9:21:34 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.trojans.zip
    6/24/2008 9:22:07 AM downloaded update Detection rules: Update
    6/24/2008 9:22:07 AM - URL: http://www.spybotupdates.biz/updates/files/includes.zip
    6/24/2008 9:22:07 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip
    6/24/2008 9:22:28 AM downloaded update English descriptions
    6/24/2008 9:22:28 AM - URL: http://www.spybotupdates.biz/updates...sc.english.zip
    6/24/2008 9:22:28 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\desc.english.zip
    6/24/2008 9:22:30 AM downloaded update English language
    6/24/2008 9:22:30 AM - URL: http://www.spybotupdates.biz/updates...ng.english.zip
    6/24/2008 9:22:30 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\lang.english.zip
    6/24/2008 9:22:31 AM downloaded update F/P Fixes
    6/24/2008 9:22:31 AM - URL: http://www.xteq.de/spybot/updates/fpfix.zip
    6/24/2008 9:22:31 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\fpfix.zip
    6/24/2008 9:22:43 AM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    7/16/2008 2:48:31 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    7/16/2008 2:48:58 PM downloaded update Detection rules: Hijackers
    7/16/2008 2:48:58 PM - URL: http://www.spybotupdates.biz/updates....hijackers.zip
    7/16/2008 2:48:58 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.hijackers.zip
    7/16/2008 2:49:03 PM downloaded update Detection rules: Keyloggers
    7/16/2008 2:49:03 PM - URL: http://www.spybotupdates.biz/updates...keyloggers.zip
    7/16/2008 2:49:03 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.keyloggers.zip
    7/16/2008 2:49:28 PM downloaded update Detection rules: Malware
    7/16/2008 2:49:28 PM - URL: http://www.spybotupdates.biz/updates...es.malware.zip
    7/16/2008 2:49:28 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.malware.zip
    7/16/2008 2:49:37 PM downloaded update Detection rules: PUPS
    7/16/2008 2:49:37 PM - URL: http://www.spybotupdates.biz/updates...ludes.pups.zip
    7/16/2008 2:49:37 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.pups.zip
    7/16/2008 2:49:38 PM downloaded update Detection rules: Security
    7/16/2008 2:49:38 PM - URL: http://www.spybotupdates.biz/updates...s.security.zip
    7/16/2008 2:49:38 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.security.zip
    7/16/2008 2:49:47 PM downloaded update Detection rules: Spybots
    7/16/2008 2:49:47 PM - URL: http://www.spybotupdates.biz/updates...es.spybots.zip
    7/16/2008 2:49:47 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.spybots.zip
    7/16/2008 2:50:23 PM downloaded update Detection rules: Supplemental
    7/16/2008 2:50:23 PM - URL: http://www.spybotupdates.biz/updates...pplemental.zip
    7/16/2008 2:50:23 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\supplemental.zip
    7/16/2008 2:50:57 PM downloaded update Detection rules: Trojans
    7/16/2008 2:50:57 PM - URL: http://www.spybotupdates.biz/updates...es.trojans.zip
    7/16/2008 2:50:57 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.trojans.zip
    7/16/2008 2:51:35 PM downloaded update Detection rules: Update
    7/16/2008 2:51:35 PM - URL: http://www.spybotupdates.biz/updates/files/includes.zip
    7/16/2008 2:51:35 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip
    7/16/2008 2:51:53 PM downloaded update English descriptions
    7/16/2008 2:51:53 PM - URL: http://www.spybotupdates.biz/updates...sc.english.zip
    7/16/2008 2:51:53 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\desc.english.zip
    7/16/2008 2:51:55 PM downloaded update English language
    7/16/2008 2:51:55 PM - URL: http://www.spybotupdates.biz/updates...ng.english.zip
    7/16/2008 2:51:55 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\lang.english.zip
    7/16/2008 3:06:31 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    7/26/2008 12:47:35 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    7/26/2008 12:47:49 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    7/26/2008 12:48:29 PM downloaded update Detection rules: Malware
    7/26/2008 12:48:29 PM - URL: http://spybot.securitywonks.org/spyb...es.malware.zip
    7/26/2008 12:48:29 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.malware.zip
    7/26/2008 12:49:06 PM downloaded update Detection rules: Supplemental
    7/26/2008 12:49:06 PM - URL: http://spybot.securitywonks.org/spyb...pplemental.zip
    7/26/2008 12:49:06 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\supplemental.zip
    7/26/2008 12:49:40 PM downloaded update Detection rules: Trojans
    7/26/2008 12:49:40 PM - URL: http://spybot.securitywonks.org/spyb...es.trojans.zip
    7/26/2008 12:49:40 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.trojans.zip
    7/26/2008 12:50:44 PM downloaded update Detection rules: Update
    7/26/2008 12:50:44 PM - URL: http://spybot.securitywonks.org/spyb...s/includes.zip
    7/26/2008 12:50:44 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip
    7/26/2008 12:52:55 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    7/26/2008 4:01:55 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
    should I run that dss.exe as I was told in the post that I did not respond to in time? http://forums.spybot.info/showthread.php?t=31101

    thanks or you time
  2. 2008-07-30, 15:01 #2
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    You seem to have posted some other log than hjt log Please run DSS.exe and post back the reports it generates.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  3. 2008-07-31, 10:06 #3
    justime8
    justime8 is offline
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default ok here it is

    Deckard's System Scanner v20071014.68
    Run by justin2 on 2008-07-30 23:54:40
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    34: 2008-07-31 07:54:46 UTC - RP167 - Deckard's System Scanner Restore Point
    33: 2008-07-31 01:13:05 UTC - RP166 - System Checkpoint
    32: 2008-07-30 01:10:36 UTC - RP165 - System Checkpoint
    31: 2008-07-29 00:32:22 UTC - RP164 - System Checkpoint
    30: 2008-07-28 00:10:36 UTC - RP163 - System Checkpoint


    -- First Restore Point --
    1: 2008-07-02 02:40:33 UTC - RP134 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as justin2.exe) ---------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:56:18 PM, on 7/30/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
    C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
    C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
    C:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Documents and Settings\justin2\Desktop\dss.exe
    C:\DOCUME~1\justin2\Desktop\HIJACK~1\justin2.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mtasolutions.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mtasolutions.com/
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/gam...ts/y/tt5_x.cab
    O16 - DPF: Yahoo! Poker - http://download2.games.yahoo.com/gam...ts/y/pt3_x.cab
    O16 - DPF: Yahoo! Pool 2 - http://download2.games.yahoo.com/gam...s/y/poti_x.cab
    O16 - DPF: Yahoo! Pyramids - http://download2.games.yahoo.com/gam...s/y/pyt1_x.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
    O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
    O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
    O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcDataSrv.exe
    O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcSandraSrv.exe
    O24 - Desktop Component AutorunsDisabled: (no name) - (no file)

    --
    End of file - 5360 bytes

    -- File Associations -----------------------------------------------------------

    .exe - exefile - shell\open\command - "%1" %*


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R1 ClntMgmt (Compaq Client Management Driver) - c:\windows\system32\drivers\clntmgmt.sys <Not Verified; Compaq Computer Corp; Compaq Client Management Driver>

    S4 catchme - c:\docume~1\justin2\locals~1\temp\catchme.sys (file missing)
    S4 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing)


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 CPQALERT (Compaq Local Alerter) - c:\program files\compaq\compaq management agents\cpqalert.exe <Not Verified; Compaq Computer Corporation; Compaq Management Agents>
    R2 CpqDfwWebAgent (Compaq Remote Diagnostics Enabling Agent) - c:\windows\cpqdiag\cpqdfwag.exe <Not Verified; Compaq Computer Corporation; Compaq Remote Diagnostics Enabling Agent>
    R2 cpqWebDmi (Compaq DMI Web Agent) - c:\progra~1\compaq\compaq~1\cpqweb~1\webdmi.exe <Not Verified; Compaq Computer Corporation; Compaq Management Agents>
    R2 Diskeeper - "c:\program files\executive software\diskeeper\dkservice.exe" <Not Verified; Executive Software International, Inc.; Diskeeper (TM) Disk Defragmenter>

    S2 cpqdmi - c:\progra~1\compaq\compaq~1\cpqdmi.exe <Not Verified; Compaq Computer Corporation; Compaq Management Agents>
    S4 WIN32SL - c:\program files\compaq\compaq management agents\dmi\win32\bin\win32sl.exe <Not Verified; Intel; DMI 2.0 SDK>


    -- Device Manager: Disabled ----------------------------------------------------

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: SMC EZ Card 10/100 PCI (SMC1211TX)
    Device ID: PCI\VEN_1113&DEV_1211&SUBSYS_12111113&REV_10\4&25296D99&0&20F0
    Manufacturer: SMC
    Name: SMC EZ Card 10/100 PCI (SMC1211TX)
    PNP Device ID: PCI\VEN_1113&DEV_1211&SUBSYS_12111113&REV_10\4&25296D99&0&20F0
    Service: rtl8139

    Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
    Description: PS/2 Compatible Mouse
    Device ID: ACPI\PNP0F13\4&36B16CB7&0
    Manufacturer: Microsoft
    Name: PS/2 Compatible Mouse
    PNP Device ID: ACPI\PNP0F13\4&36B16CB7&0
    Service: i8042prt


    -- Files created between 2008-06-30 and 2008-07-30 -----------------------------

    Nothing created in this timespan.


    -- Find3M Report ---------------------------------------------------------------

    2008-07-26 10:50:06 0 d-------- C:\Documents and Settings\justin2\Application Data\AVG7
    2008-06-26 12:05:18 0 d-------- C:\Documents and Settings\justin2\Application Data\Adobe
    2008-06-24 15:17:47 0 d-------- C:\Program Files\Enigma Software Group
    2008-06-16 18:56:34 0 d-------- C:\Program Files\Common Files\Adobe
    2008-06-16 18:48:41 3333 --a----c- C:\WINDOWS\mozver.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/25/2008 04:24 AM]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [12/05/2007 01:41 AM]
    "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [05/26/2008 08:45 PM]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [12/05/2007 01:41 AM]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
    "RunNarrator"=Narrator.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"=0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @="Volume shadow copy"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChkAdmin]
    C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DrvLsnr]
    C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrust PestPatrol Active Protection]
    none

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    "C:\Program Files\Messenger\msmsgs.exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    nwiz.exe /install

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinPatrol]
    C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "WIN32SL"=2 (0x2)
    "SoundMAX Agent Service (default)"=2 (0x2)
    "gusvc"=3 (0x3)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "EasyFreeWebCam"=
    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    "nwiz"=nwiz.exe /install
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
    "DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
    "CPQDFWAG"=C:\WINDOWS\Cpqdiag\CpqDfwAg.exe


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0c3f2c8-aa02-11dc-833c-806d6172696f}\Name]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0c3f2c8-aa02-11dc-833c-806d6172696f}\Name- Sub Command]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9636d46-2b44-11dc-a62b-806d6172696f}]
    AutoRun\command- D:\autorun.exe




    -- End of Deckard's System Scanner: finished at 2008-07-30 23:56:47 ------------
  4. 2008-07-31, 21:53 #4
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi


    Show hidden files
    -----------------
    * Click Start.
    * Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading select Show hidden files and folders.
    * Uncheck the Hide protected operating system files (recommended) option.
    * Click Yes to confirm.
    * Click OK.


    Start hjt, do a system scan, check:
    O24 - Desktop Component AutorunsDisabled: (no name) - (no file)

    Close browsers and fix checked.


    Creating & executing batch file
    -------------------------------

    Open notepad and then copy and paste the bolded lines below into it. Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop. (If you are still unsure on how to do this there is a little tutorial with pictures here)
    @echo off
    sc stop catchme
    sc delete catchme

    Double-click on fixes.bat file to execute it.



    Delete following file if found:
    c:\Documents and Settings\justin2\Local Settings\temp\catchme.sys


    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 7.
    • Scroll down to where it says
      The J2SE Runtime Environment (JRE) allows end-users to run Java applications.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.




    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache
    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Please run an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, click Yes.
    • The program will launch and start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings and select the following:
    Scan using the following Anti-Virus database:
    • Extended (If available, otherwise Standard)
    Scan Options:
    • Scan Archives
    • Scan Mail Bases
    • Click OK.
    • Under
      select a target to scan
      , select My Computer.
    • The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.
    Once the scan is complete:
    • Click on the Save as Text button.
    • Save the file to your desktop.
    • Copy and paste that information into your next post if the AV content will fit into one post only. Post a fresh hjt log too.



    Note for Internet Explorer 7 users: If at any time you have trouble with the Accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

    If having a problme doing the above

    Make sure that your Internet security settings are set to default values.

    To set default security settings for Internet Explorer:

    * Open Internet Explorer.
    * Go to the Tools menu, then choose Internet Options.
    * Click on the Security tab.
    * Make sure that all four item (Internet, Local intranet, Trusted sites, and Restricted sites) are set to their default settings.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  5. 2008-08-01, 05:51 #5
    justime8
    justime8 is offline
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default

    ok here is the new hjt log and a kaspersky log i hope this is right ! i have followed all your instructions and now i am going to run s&d again see if it still comes up with a trojan. here they are.

    -------------------------------------------------------------------------
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:45:55 PM, on 7/31/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
    C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
    C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
    C:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
    C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\justin2\Desktop\HiJackThis\justin2.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mtasolutions.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mtasolutions.com/
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Yahoo! Literati - http://download2.games.yahoo.com/gam...ts/y/tt5_x.cab
    O16 - DPF: Yahoo! Poker - http://download2.games.yahoo.com/gam...ts/y/pt3_x.cab
    O16 - DPF: Yahoo! Pool 2 - http://download2.games.yahoo.com/gam...s/y/poti_x.cab
    O16 - DPF: Yahoo! Pyramids - http://download2.games.yahoo.com/gam...s/y/pyt1_x.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
    O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
    O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
    O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcDataSrv.exe
    O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005\RpcSandraSrv.exe
    O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

    --
    End of file - 5854 bytes
    and here is the kaspersky log

    ------------------------------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Thursday, July 31, 2008 7:35:10 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 1/08/2008
    Kaspersky Anti-Virus database records: 1037143


    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    A:\
    C:\
    D:\

    Scan Statistics
    Total number of scanned objects 26429
    Number of viruses found 1
    Number of infected objects 3
    Number of suspicious objects 0
    Duration of the scan process 00:29:57

    Infected Object Name Virus Name Last Action
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\justin2\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\justin2\Desktop\saved downloads\Spiceworks.exe/stream/data2937 Infected: not-a-virus:PSWTool.Win32.ProductKey.b skipped
    C:\Documents and Settings\justin2\Desktop\saved downloads\Spiceworks.exe/stream Infected: not-a-virus:PSWTool.Win32.ProductKey.b skipped
    C:\Documents and Settings\justin2\Desktop\saved downloads\Spiceworks.exe NSIS: infected - 2 skipped
    C:\Documents and Settings\justin2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\justin2\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\justin2\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\justin2\Local Settings\History\History.IE5\MSHist012008073120080801\index.dat Object is locked skipped
    C:\Documents and Settings\justin2\Local Settings\Temp\~DFE41A.tmp Object is locked skipped
    C:\Documents and Settings\justin2\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\justin2\ntuser.dat Object is locked skipped
    C:\Documents and Settings\justin2\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\COMPAQ\Compaq Management Agents\Dmi\Win32\mifdb\errors.log Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\SystemVolume Information\_restore{4E4ECD0F-3EF2-446D-9329-2A24EB5506A6}\RP169\change.log Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
    C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\TEMP\Perflib_Perfdata_690.dat Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    Scan process completed.
  6. 2008-08-01, 07:56 #6
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    That looks quite good Are you familiar with C:\Documents and Settings\justin2\Desktop\saved downloads\Spiceworks.exe file? If not upload it to http://virusscan.jotti.org and post back the results.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  7. 2008-08-01, 08:27 #7
    justime8
    justime8 is offline
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default

    ok here is the http://virusscan.jotti.org/ scan and i need to ask
    my S&D scan says twice that it has a problem (trojan) and the the error is stored in a error log but I have not been able to locate the log so looking at it is out. thats where you come in !!! just finnished a new S&D scan if I could look at the log I may be able to find the problem.


    Scan taken on 01 Aug 2008 06:17:34 (GMT)
    A-Squared Found nothing
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found nothing
    Fortinet Found nothing
    Ikarus Found nothing
    Kaspersky Anti-Virus Found not-a-virus:PSWTool.Win32.ProductKey.b
    NOD32 Found nothing
    Norman Virus Control Found nothing
    Panda Antivirus Found nothing
    Sophos Antivirus Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing
  8. 2008-08-01, 08:35 #8
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Ok. The Kaspersky finding is quite likely a false positive. Which version of Spybot are you using?
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  9. 2008-08-01, 08:39 #9
    justime8
    justime8 is offline
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default

    version 1.4 with all updates current
  10. 2008-08-01, 08:55 #10
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Please uninstall it and then download & install latest one found here. Try running scan with it.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules