Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 28

Thread: cmdservice

  1. 2006-11-20, 01:07 #11
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default

    STATUS: FINISHED
    Complete scanning result of "bt197.dll", received in VirusTotal at 11.20.2006, 00:45:40 (CET).
    Antivirus Version Update Result
    AntiVir 7.2.0.39 11.19.2006 no virus found
    Authentium 4.93.8 11.17.2006 no virus found
    Avast 4.7.892.0 11.18.2006 no virus found
    AVG 386 11.19.2006 no virus found
    BitDefender 7.2 11.19.2006 no virus found
    CAT-QuickHeal 8.00 11.18.2006 no virus found
    ClamAV devel-20060426 11.19.2006 no virus found
    DrWeb 4.33 11.19.2006 no virus found
    eSafe 7.0.14.0 11.19.2006 no virus found
    eTrust-InoculateIT 23.73.59 11.18.2006 no virus found
    eTrust-Vet 30.3.3197 11.17.2006 no virus found
    Ewido 4.0 11.19.2006 no virus found
    Fortinet 2.82.0.0 11.19.2006 suspicious
    F-Prot 3.16f 11.17.2006 no virus found
    F-Prot4 4.2.1.29 11.17.2006 no virus found
    Ikarus 0.2.65.0 11.19.2006 no virus found
    Kaspersky 4.0.2.24 11.19.2006 no virus found
    McAfee 4899 11.18.2006 W32/Kibik.dll
    Microsoft 1.1609 11.19.2006 no virus found
    NOD32v2 1871 11.19.2006 no virus found
    Norman 5.80.02 11.17.2006 no virus found
    Panda 9.0.0.4 11.19.2006 no virus found
    Prevx1 V2 11.20.2006 no virus found
    Sophos 4.11.0 11.16.2006 no virus found
    TheHacker 6.0.3.122 11.18.2006 no virus found
    UNA 1.83 11.17.2006 no virus found
    VBA32 3.11.1 11.19.2006 no virus found
    VirusBuster 4.3.15:9 11.19.2006 no virus found
    Aditional Information
    File size: 136704 bytes
    MD5: ce4b3d5f3bfc4da402fccdca92e284b8
    SHA1: ed7b3eb8f55f281cb517cfb6ec9156bf496a3cd1
  2. 2006-11-20, 01:08 #12
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default

    STATUS: FINISHED
    Complete scanning result of "test.exe", received in VirusTotal at 11.20.2006, 00:41:44 (CET).
    Antivirus Version Update Result
    AntiVir 7.2.0.39 11.19.2006 HEUR/Crypted
    Authentium 4.93.8 11.17.2006 no virus found
    Avast 4.7.892.0 11.18.2006 no virus found
    AVG 386 11.19.2006 no virus found
    BitDefender 7.2 11.19.2006 no virus found
    CAT-QuickHeal 8.00 11.18.2006 (Suspicious) - DNAScan
    ClamAV devel-20060426 11.19.2006 no virus found
    DrWeb 4.33 11.19.2006 no virus found
    eSafe 7.0.14.0 11.19.2006 Suspicious Trojan/Worm
    eTrust-InoculateIT 23.73.59 11.18.2006 no virus found
    eTrust-Vet 30.3.3197 11.17.2006 no virus found
    Ewido 4.0 11.19.2006 no virus found
    Fortinet 2.82.0.0 11.19.2006 suspicious
    F-Prot 3.16f 11.17.2006 no virus found
    F-Prot4 4.2.1.29 11.17.2006 no virus found
    Ikarus 0.2.65.0 11.19.2006 no virus found
    Kaspersky 4.0.2.24 11.19.2006 no virus found
    McAfee 4899 11.18.2006 QHosts-14
    Microsoft 1.1609 11.19.2006 no virus found
    NOD32v2 1871 11.19.2006 no virus found
    Norman 5.80.02 11.17.2006 no virus found
    Panda 9.0.0.4 11.19.2006 Suspicious file
    Prevx1 V2 11.20.2006 no virus found
    Sophos 4.11.0 11.16.2006 Mal/Packer
    TheHacker 6.0.3.122 11.18.2006 no virus found
    UNA 1.83 11.17.2006 no virus found
    VBA32 3.11.1 11.19.2006 no virus found
    VirusBuster 4.3.15:9 11.19.2006 no virus found
    Aditional Information
    File size: 180741 bytes
    MD5: 603218f10384d6214bf71b402680dad7
    SHA1: 8c52fc73e619c3097011013c617ba07b2a3646a5
    packers: FSG
  3. 2006-11-20, 01:09 #13
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default

    STATUS: FINISHED
    Complete scanning result of "m96pk.dll", received in VirusTotal at 11.20.2006, 00:29:07 (CET).
    Antivirus Version Update Result
    AntiVir 7.2.0.39 11.19.2006 no virus found
    Authentium 4.93.8 11.17.2006 no virus found
    Avast 4.7.892.0 11.18.2006 no virus found
    AVG 386 11.19.2006 no virus found
    BitDefender 7.2 11.19.2006 no virus found
    CAT-QuickHeal 8.00 11.18.2006 no virus found
    ClamAV devel-20060426 11.19.2006 no virus found
    DrWeb 4.33 11.19.2006 no virus found
    eSafe 7.0.14.0 11.19.2006 no virus found
    eTrust-InoculateIT 23.73.59 11.18.2006 no virus found
    eTrust-Vet 30.3.3197 11.17.2006 no virus found
    Ewido 4.0 11.19.2006 no virus found
    Fortinet 2.82.0.0 11.19.2006 no virus found
    F-Prot 3.16f 11.17.2006 no virus found
    F-Prot4 4.2.1.29 11.17.2006 no virus found
    Ikarus 0.2.65.0 11.19.2006 no virus found
    Kaspersky 4.0.2.24 11.19.2006 no virus found
    McAfee 4899 11.18.2006 no virus found
    Microsoft 1.1609 11.19.2006 no virus found
    NOD32v2 1871 11.19.2006 no virus found
    Norman 5.80.02 11.17.2006 no virus found
    Panda 9.0.0.4 11.19.2006 no virus found
    Prevx1 V2 11.20.2006 no virus found
    Sophos 4.11.0 11.16.2006 no virus found
    TheHacker 6.0.3.122 11.18.2006 no virus found
    UNA 1.83 11.17.2006 no virus found
    VBA32 3.11.1 11.19.2006 no virus found
    VirusBuster 4.3.15:9 11.19.2006 no virus found
    Aditional Information
    File size: 10 bytes
    MD5: 6d32f15a1e10578c79053c4de52f87b1
    SHA1: 52743bb9e7ec4795f7ae6dbb8a85f09ba044c2b5
  4. 2006-11-20, 01:10 #14
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default

    STATUS: FINISHED
    Complete scanning result of "tv28522.dll", received in VirusTotal at 11.20.2006, 00:19:19 (CET).
    Antivirus Version Update Result
    AntiVir 7.2.0.39 11.19.2006 no virus found
    Authentium 4.93.8 11.17.2006 no virus found
    Avast 4.7.892.0 11.18.2006 no virus found
    AVG 386 11.19.2006 no virus found
    BitDefender 7.2 11.19.2006 no virus found
    CAT-QuickHeal 8.00 11.18.2006 no virus found
    ClamAV devel-20060426 11.19.2006 no virus found
    DrWeb 4.33 11.19.2006 no virus found
    eSafe 7.0.14.0 11.19.2006 no virus found
    eTrust-InoculateIT 23.73.59 11.18.2006 no virus found
    eTrust-Vet 30.3.3197 11.17.2006 no virus found
    Ewido 4.0 11.19.2006 no virus found
    Fortinet 2.82.0.0 11.19.2006 suspicious
    F-Prot 3.16f 11.17.2006 no virus found
    F-Prot4 4.2.1.29 11.17.2006 no virus found
    Ikarus 0.2.65.0 11.19.2006 no virus found
    Kaspersky 4.0.2.24 11.19.2006 no virus found
    McAfee 4899 11.18.2006 W32/Kibik.dll
    Microsoft 1.1609 11.19.2006 no virus found
    NOD32v2 1871 11.19.2006 no virus found
    Norman 5.80.02 11.17.2006 no virus found
    Panda 9.0.0.4 11.19.2006 no virus found
    Prevx1 V2 11.20.2006 no virus found
    Sophos 4.11.0 11.16.2006 no virus found
    TheHacker 6.0.3.122 11.18.2006 no virus found
    UNA 1.83 11.17.2006 no virus found
    VBA32 3.11.1 11.19.2006 no virus found
    VirusBuster 4.3.15:9 11.19.2006 no virus found
    Aditional Information
    File size: 1192960 bytes
    MD5: 797b4d775bb68bd619e9e0f3a246f2bb
    SHA1: efe154f0a041afea17aee9df80e99dcda9f8bdd0
  5. 2006-11-20, 08:10 #15
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Delete these:

    C:\WINDOWS\system32\bt197.dll
    C:\Documents and Settings\R F\test.exe
    C:\WINDOWS\system32\tv28522.dll

    Empty Recycle Bin

    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.


    Send:

    - a fresh HijackThis log
    - kaspersky report
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  6. 2006-11-20, 16:43 #16
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default

    Logfile of HijackThis v1.99.1
    Scan saved at 8:41:41 AM, on 11/20/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\WINDOWS\system32\TCtrlIOHook.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\toshiba\ivp\ism\pinger.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HiJackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ricfelder.com/RicHomePage.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
    O2 - BHO: MSN Explorer Plugin - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\msnxplpi3.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
    O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
    O4 - HKLM\..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1150412785328
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://weboffice.webex.com/client/T...ex/ieatgpc.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  7. 2006-11-20, 16:46 #17
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default 1st half of report

    KASPERSKY ONLINE SCANNER REPORT
    Monday, November 20, 2006 8:40:14 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.83.0
    Kaspersky Anti-Virus database last update: 20/11/2006
    Kaspersky Anti-Virus database records: 243243


    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    C:\
    D:\

    Scan Statistics
    Total number of scanned objects 53057
    Number of viruses found 15
    Number of infected objects 142 / 0
    Number of suspicious objects 6
    Duration of the scan process 00:43:02

    Infected Object Name Virus Name Last Action
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC2.zip/MTE3NDI6ODoxNg.exe Suspicious: Password-protected-EXE skipped

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC2.zip ZIP: suspicious - 1 skipped

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC3.zip/drsmartload849a849o.exe Suspicious: Password-protected-EXE skipped

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC3.zip ZIP: suspicious - 1 skipped

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC4.zip/drsmartload46a46o.exe Suspicious: Password-protected-EXE skipped

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC4.zip ZIP: suspicious - 1 skipped

    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

    C:\Documents and Settings\Ric Felder\Cookies\index.dat Object is locked skipped

    C:\Documents and Settings\Ric Felder\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Documents and Settings\Ric Felder\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

    C:\Documents and Settings\Ric Felder\Local Settings\History\History.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Ric Felder\Local Settings\Temp\~DFF438.tmp Object is locked skipped

    C:\Documents and Settings\Ric Felder\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Documents and Settings\Ric Felder\NTUSER.DAT Object is locked skipped

    C:\Documents and Settings\Ric Felder\ntuser.dat.LOG Object is locked skipped

    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll Object is locked skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\AVApp.log Object is locked skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\AVError.log Object is locked skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\AVVirus.log Object is locked skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\02511AA5 Infected: Trojan-Downloader.Win32.Adload.ha skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0AB93B9A/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0AB93B9A/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0AB93B9A NSIS: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\0AB93B9A CryptFF: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\10CA6932 Infected: Exploit.JS.XMLCore.a skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\144B453D Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\14B86CDF Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\14BB16DB Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\1801356C Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\21DA3397 Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\2A9B29FC Infected: Trojan-Downloader.Win32.VB.afl skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\31BC7BF8/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\31BC7BF8/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\31BC7BF8 NSIS: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\31BC7BF8 CryptFF: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\33330F91 Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\361473BB.exe Infected: Trojan-Downloader.Win32.Small.cyh skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\36AE2912.exe Infected: Trojan-Downloader.Win32.Small.cyh skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\36B82708.exe Infected: Trojan-Downloader.Win32.Small.cyh skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\50811999/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\50811999/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\50811999 NSIS: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\50811999 CryptFF: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\5239576C Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\5C115598 Infected: Trojan-Downloader.Win32.Adload.gw skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\629956BE.exe Infected: Trojan-Downloader.Win32.Adload.ff skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64222A78 Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64255474/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64255474/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64255474 NSIS: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\64255474 CryptFF: infected - 2 skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\642B286D Infected: Trojan-Downloader.Win32.Adload.fu skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\642F526A Infected: Trojan-Downloader.Win32.Adload.fu skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\6C0035E7 Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\72922D2A.exe Infected: Trojan-Downloader.Win32.Adload.fg skipped

    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP113\A0014831.exe Infected: Trojan-Downloader.Win32.Adload.fg skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015290.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015296.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015312.exe Infected: Trojan-Downloader.Win32.VB.afl skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015313.exe Infected: Trojan-Downloader.Win32.Adload.gw skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015315.exe Infected: Trojan-Downloader.Win32.VB.amb skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015316.exe Infected: Trojan-Downloader.Win32.VB.alg skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015317.exe Infected: Trojan-Downloader.Win32.Adload.ha skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015320.exe Infected: Trojan-Downloader.Win32.Adload.fg skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015323.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015336.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015337.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP121\A0015351.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015389.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015390.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015398.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015399.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015407.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015408.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015416.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015417.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015426.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015427.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015435.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015436.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015465.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015466.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015475.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP122\A0015477.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015527.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015528.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
  8. 2006-11-20, 16:47 #18
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default 2nd half of Kaspersky report

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015547.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015550.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015605.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015606.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015613.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015614.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015618.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015623.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015628.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015633.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015639.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015641.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015647.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015652.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015653.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015654.exe/deskbar.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015654.exe/deskbar.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015654.exe/deskbar.exe Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015654.exe ZIP: infected - 3 skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015655.exe/deskbar.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015655.exe/deskbar.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015655.exe/deskbar.exe Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015655.exe ZIP: infected - 3 skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015656.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015656.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015656.exe NSIS: infected - 2 skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015657.exe Infected: Trojan-Downloader.Win32.Adload.fu skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015658.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015660.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015662.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015667.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015671.exe Infected: not-a-virus:AdWare.Win32.AdURL.c skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015673.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015678.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015685.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015690.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015697.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP124\A0015703.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP125\A0015708.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP125\A0015713.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP126\A0015742.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0015763.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0015772.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0015777.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0015779.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0015785.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0015790.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0016789.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0017788.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0017793.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP127\A0018792.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP128\A0018890.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP128\A0018903.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP128\A0018904.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP128\A0018920.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP128\A0018921.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018932.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018933.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018934.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018935.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018936.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018937.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018939.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018947.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP129\A0018952.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018959.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018967.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018972.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018975.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018980.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018983.exe Infected: Trojan.Win32.Pakes skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018993.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018995.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018996.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP130\A0018997.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped

    C:\System Volume Information\_restore{1D1D6F93-1B0C-4060-8D79-09274A81BD2A}\RP131\change.log Object is locked skipped

    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

    C:\WINDOWS\SchedLgU.Txt Object is locked skipped

    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\default Object is locked skipped

    C:\WINDOWS\system32\config\default.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SAM Object is locked skipped

    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY Object is locked skipped

    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

    C:\WINDOWS\system32\config\software Object is locked skipped

    C:\WINDOWS\system32\config\software.LOG Object is locked skipped

    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

    C:\WINDOWS\system32\config\system Object is locked skipped

    C:\WINDOWS\system32\config\system.LOG Object is locked skipped

    C:\WINDOWS\system32\h323log.txt Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
  9. 2006-11-20, 16:54 #19
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Empty this folder:

    C:\Program Files\Norton SystemWorks\Norton Antivirus\Quarantine\

    Empty Recycle Bin

    Re-scan with kaspersky

    Send:

    - a fresh HijackThis log
    - kaspersky report
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  10. 2006-11-20, 19:50 #20
    Keddy10
    Keddy10 is offline
    Junior Member
    Join Date
    Nov 2006
    Posts
    23

    Default

    Logfile of HijackThis v1.99.1
    Scan saved at 11:48:33 AM, on 11/20/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\WINDOWS\system32\TCtrlIOHook.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\toshiba\ivp\ism\pinger.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HiJackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ricfelder.com/RicHomePage.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
    O2 - BHO: MSN Explorer Plugin - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\msnxplpi3.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
    O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
    O4 - HKLM\..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1150412785328
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://weboffice.webex.com/client/T...ex/ieatgpc.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules