Need Help removing virtumode, win 32, and others

[KELkel]

followed tashi's "BEFORE you POST" KASPERSKY is long #of viruses 7 infected objects 3770 ran spybot in safe mode until no more showed up
here is my hjt log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:02:41 AM, on 11/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\dumprep.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.musiciansfriend.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://actelnet.com.1dial.com/?nocache=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [0878296a] rundll32.exe "C:\WINDOWS\system32\vqydqfyb.dll",b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0766F5F2-BB5C-492E-A020-A83288BFDD8F}: NameServer = 205.152.37.23 205.152.144.23
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9363 bytes

thanks for any help.

 

[Shaba]

Hi KELkel

Rename HijackThis.exe to KELkel.exe and post back a fresh HijackThis log, please

 

[KELkel]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:18:32 AM, on 11/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\Kelkel.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.musiciansfriend.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://actelnet.com.1dial.com/?nocache=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {664ddc44-690c-9729-ce14-0e1603980d60} - {06d08930-61e0-41ec-9279-c09644cdd466} - C:\WINDOWS\system32\vahhsbgd.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {82A2E07E-6D8A-460A-8987-187B2E75779F} - C:\WINDOWS\system32\awtst.dll
O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - C:\WINDOWS\system32\khffefc.dll
O2 - BHO: (no name) - {A69373EE-45C5-4A09-8A6C-0509C0B5A123} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: (no name) - {E4B99955-AE8B-488C-9857-F92C7DA90537} - (no file)
O2 - BHO: (no name) - {EDE62101-B61D-4716-89B8-78F92881A143} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [0878296a] rundll32.exe "C:\WINDOWS\system32\vqydqfyb.dll",b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0766F5F2-BB5C-492E-A020-A83288BFDD8F}: NameServer = 205.152.37.23 205.152.144.23
O20 - Winlogon Notify: khffefc - C:\WINDOWS\SYSTEM32\khffefc.dll
O20 - Winlogon Notify: winrge32 - winrge32.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 10757 bytes

 

[Shaba]

Hi

We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

1. Download combofix from one of these links and save it to Desktop:
Link1
Link2
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Post:

- a fresh HijackThis log
- combofix report

 

[KELkel]

okay here is the new logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:39 AM, on 11/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\dumprep.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\notepad.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\Kelkel.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.musiciansfriend.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://actelnet.com.1dial.com/?nocache=
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {664ddc44-690c-9729-ce14-0e1603980d60} - {06d08930-61e0-41ec-9279-c09644cdd466} - C:\WINDOWS\system32\vahhsbgd.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {A69373EE-45C5-4A09-8A6C-0509C0B5A123} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: (no name) - {E4B99955-AE8B-488C-9857-F92C7DA90537} - (no file)
O2 - BHO: (no name) - {EDE62101-B61D-4716-89B8-78F92881A143} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [0878296a] rundll32.exe "C:\WINDOWS\system32\vqydqfyb.dll",b
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab
O20 - Winlogon Notify: winrge32 - winrge32.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9624 bytes

ComboFix 07-11-08.1 - Compaq_Owner 2007-11-14 10:01:51.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.164 [GMT -5:00]
Running from: C:\Documents and Settings\Compaq_Owner\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Compaq_Owner\Desktop\Live Safety Center.lnk
C:\Documents and Settings\Compaq_Owner\Desktop\Online Security Guide.lnk
C:\Documents and Settings\Compaq_Owner\Favorites\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\awtst.dll
C:\WINDOWS\system32\csrs.exe
C:\WINDOWS\system32\firewall.exe
C:\WINDOWS\system32\iexplore.exe
C:\WINDOWS\system32\khffefc.dll
C:\WINDOWS\system32\tstwa.bak2
C:\WINDOWS\system32\tstwa.ini
C:\WINDOWS\system32\tstwa.ini2
C:\WINDOWS\system32\tstwa.tmp
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-10-14 to 2007-11-14 )))))))))))))))))))))))))))))))
.

2007-11-14 09:57 58,368 --a------ C:\WINDOWS\NirCmd.exe
2007-11-13 22:52 <DIR> d-------- C:\VundoFix Backups
2007-11-13 02:00 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-12 18:35 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-12 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\WINDOWS
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\Application Data\Symantec
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\Application Data\Intuit
2007-11-12 14:35 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE\Application Data\Symantec
2007-11-12 14:35 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE\Application Data\Intuit
2007-11-11 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-11 03:53 88,128 --a------ C:\WINDOWS\system32\vqydqfyb.dll
2007-11-11 03:51 79,936 --a------ C:\WINDOWS\system32\vahhsbgd.dll
2007-11-11 03:36 2,432 --a------ C:\WINDOWS\system32\unpr.sys
2007-11-08 23:36 80,448 --a------ C:\WINDOWS\system32\qeqqwqbm.dll
2007-11-08 23:32 145,984 --a------ C:\WINDOWS\system32\wnldayii.dll
2007-11-08 23:31 82,496 --a------ C:\WINDOWS\system32\ndiwvtoj.exe
2007-11-08 17:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2007-11-08 17:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intuit
2007-11-08 17:15 <DIR> d-------- C:\temp
2007-11-08 00:14 <DIR> d-------- C:\Program Files\Nstorm
2007-10-14 18:24 <DIR> d-------- C:\Documents and Settings\kelly\Application Data\funkitron

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-14 03:03 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-09 05:22 --------- d-----w C:\Program Files\Norton Internet Security
2007-11-09 04:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-09 04:50 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-09 04:50 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-09 04:50 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-09 04:50 --------- d-----w C:\Program Files\Symantec
2007-10-24 14:48 --------- d-----w C:\Program Files\Common Files\Sandlot Shared
2007-10-24 14:40 754 ----a-w C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
2007-10-16 02:34 --------- d-----w C:\Documents and Settings\kelly\Application Data\Image Zone Express
2007-10-13 20:45 --------- d-----w C:\Documents and Settings\kelly\Application Data\PlayFirst
2007-10-11 02:14 --------- d-----w C:\Documents and Settings\kelly\Application Data\CyberLink
2007-10-02 01:51 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-01 19:49 98,184 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-01 19:49 31,624 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-01 19:49 28,040 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-01 19:49 23,944 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-01 19:49 189,320 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-01 19:48 12,680 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-09-20 13:03 --------- d-----w C:\Program Files\LimeWire
2007-08-02 11:25 272 ----a-w C:\Documents and Settings\kelly\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06d08930-61e0-41ec-9279-c09644cdd466}]
2007-11-11 03:52 79936 --a------ C:\WINDOWS\system32\vahhsbgd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A69373EE-45C5-4A09-8A6C-0509C0B5A123}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4B99955-AE8B-488C-9857-F92C7DA90537}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDE62101-B61D-4716-89B8-78F92881A143}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 16:05 C:\WINDOWS\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 22:05 C:\WINDOWS\RTHDCPL.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-09 17:50]
"nwiz"="nwiz.exe" [2006-05-09 17:50 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-23 00:14]
"PCDrProfiler"="" []
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 00:34]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 04:23]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]
"0878296a"="C:\WINDOWS\system32\vqydqfyb.dll" [2007-11-11 03:54]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]

C:\Documents and Settings\Administrator.JESSE.000\Start Menu\Programs\Startup\
Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-08-01 13:08:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-08-01 13:56:30]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrge32]
winrge32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awtst.dll

R0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys
S3 samhid;samhid;C:\WINDOWS\system32\drivers\samhid.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb9e0e6-be98-11db-a69e-0018f3ada583}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-11-13 22:11:43 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Compaq_Owner.job"
- c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe
"2006-12-25 00:25:20 C:\WINDOWS\Tasks\Warranty Reminder 11 month.job"
- c:\windows\system32\pcintro\reminder\Warranty_Reminder_11_month\Warranty_Reminder_11_month.bat
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-14 10:15:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-14 10:17:36 - machine was rebooted
.
--- E O F ---

 

[Shaba]

Hi

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Please click this link-->Jotti

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

C:\WINDOWS\system32\unpr.sys

Repeat step for this:

C:\WINDOWS\system32\drivers\samhid.sys

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

 

[KELkel]

File: unpr.sys
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: 4bc149d90bb94a2ee09ae6d5153932ad
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 14 Nov 2007 15:53:02 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Trojan.Rootkit.Virtob.A
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan.Win32.KillAV.cn
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan.Win32.KillAV.cn
NOD32 Found Win32/KillAV.NBU
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Service
Service load: 0% 100%

File: Samhid.sys
Status: OK
MD5: 71cec3f79b3e921d417cb8e541fff10a
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 14 Nov 2007 15:58:33 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

 

[Shaba]

Hi

Download suspicious file packer from here

Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

C:\WINDOWS\system32\unpr.sys

Go to spykiller

Press new topic, make threads title "Files for Shaba"
Include to your message a link to here, then attach the cab/zip file to your message and post the topic
If you cant locate it through the browse button just copy/paste the filename and path.

Reply to that thread after that and we'll continue

 

[Shaba]

Hi

Thanks for the file

Open notepad and copy/paste the text in the quotebox below into it:

Driver::
UNPR

File::
C:\WINDOWS\system32\vqydqfyb.dll
C:\WINDOWS\system32\vahhsbgd.dll
C:\WINDOWS\system32\unpr.sys
C:\WINDOWS\system32\qeqqwqbm.dll
C:\WINDOWS\system32\wnldayii.dll
C:\WINDOWS\system32\ndiwvtoj.exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06d08930-61e0-41ec-9279-c09644cdd466}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A69373EE-45C5-4A09-8A6C-0509C0B5A123}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E4B99955-AE8B-488C-9857-F92C7DA90537}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDE62101-B61D-4716-89B8-78F92881A143}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrge32] 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"0878296a"=-

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

 

[KELkel]

here are the new logs. Before windows shut down Data execution Program kept trying to shut down the command window. But it seemed to work.

ComboFix 07-11-08.1 - Compaq_Owner 2007-11-14 14:12:10.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.126 [GMT -5:00]
Running from: C:\Documents and Settings\Compaq_Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\ndiwvtoj.exe
C:\WINDOWS\system32\qeqqwqbm.dll
C:\WINDOWS\system32\unpr.sys
C:\WINDOWS\system32\vahhsbgd.dll
C:\WINDOWS\system32\vqydqfyb.dll
C:\WINDOWS\system32\wnldayii.dll
.

((((((((((((((((((((((((( Files Created from 2007-10-14 to 2007-11-14 )))))))))))))))))))))))))))))))
.

2007-11-14 09:57 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-13 22:52 <DIR> d-------- C:\VundoFix Backups
2007-11-13 02:00 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-12 18:35 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-12 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\WINDOWS
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\Application Data\Symantec
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\Application Data\Intuit
2007-11-12 14:35 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE\Application Data\Symantec
2007-11-12 14:35 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE\Application Data\Intuit
2007-11-11 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-11 03:53 88,128 --a------ C:\WINDOWS\system32\vqydqfyb.dll
2007-11-11 03:51 79,936 --a------ C:\WINDOWS\system32\vahhsbgd.dll
2007-11-11 03:36 2,432 --a------ C:\WINDOWS\system32\unpr.sys
2007-11-08 23:36 80,448 --a------ C:\WINDOWS\system32\qeqqwqbm.dll
2007-11-08 23:32 145,984 --a------ C:\WINDOWS\system32\wnldayii.dll
2007-11-08 23:31 82,496 --a------ C:\WINDOWS\system32\ndiwvtoj.exe
2007-11-08 17:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2007-11-08 17:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intuit
2007-11-08 17:15 <DIR> d-------- C:\temp
2007-11-08 00:14 <DIR> d-------- C:\Program Files\Nstorm
2007-10-14 18:24 <DIR> d-------- C:\Documents and Settings\kelly\Application Data\funkitron

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-14 03:03 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-09 05:22 --------- d-----w C:\Program Files\Norton Internet Security
2007-11-09 04:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-09 04:50 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-09 04:50 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-09 04:50 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-09 04:50 --------- d-----w C:\Program Files\Symantec
2007-10-24 14:48 --------- d-----w C:\Program Files\Common Files\Sandlot Shared
2007-10-24 14:40 754 ----a-w C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
2007-10-16 02:34 --------- d-----w C:\Documents and Settings\kelly\Application Data\Image Zone Express
2007-10-13 20:45 --------- d-----w C:\Documents and Settings\kelly\Application Data\PlayFirst
2007-10-11 02:14 --------- d-----w C:\Documents and Settings\kelly\Application Data\CyberLink
2007-10-02 01:51 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-01 19:49 98,184 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-01 19:49 31,624 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-01 19:49 28,040 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-01 19:49 23,944 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-01 19:49 189,320 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-01 19:48 12,680 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-09-20 13:03 --------- d-----w C:\Program Files\LimeWire
2007-08-02 11:25 272 ----a-w C:\Documents and Settings\kelly\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((( snapshot@2007-11-14_10.16.48.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-29 23:56:19 146,432 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-29 23:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe
- 2007-11-14 14:49:52 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-11-14 19:17:48 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-11-14 14:49:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-11-14 19:17:48 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-11-14 14:49:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-11-14 19:17:49 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-07-22 23:39:27 289,792 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-07-22 23:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 16:05 C:\WINDOWS\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 22:05 C:\WINDOWS\RTHDCPL.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-09 17:50]
"nwiz"="nwiz.exe" [2006-05-09 17:50 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-23 00:14]
"PCDrProfiler"="" []
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 00:34]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 04:23]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]

C:\Documents and Settings\Administrator.JESSE.000\Start Menu\Programs\Startup\
Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-08-01 13:08:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-08-01 13:56:30]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22]

S3 samhid;samhid;C:\WINDOWS\system32\drivers\samhid.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb9e0e6-be98-11db-a69e-0018f3ada583}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-11-13 22:11:43 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Compaq_Owner.job"
- c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe
"2006-12-25 00:25:20 C:\WINDOWS\Tasks\Warranty Reminder 11 month.job"
- c:\windows\system32\pcintro\reminder\Warranty_Reminder_11_month\Warranty_Reminder_11_month.bat
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-14 14:18:53
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-14 14:21:18 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-14 10:17
.
--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:24:20 PM, on 11/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\notepad.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Trend Micro\HijackThis\Kelkel.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.musiciansfriend.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://actelnet.com.1dial.com/?nocache=
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9187 bytes

 

[Shaba]

Hi

Please do that again, driver deletion seemed to work but not file deletions

 

[KELkel]

ComboFix 07-11-08.1 - Compaq_Owner 2007-11-15 12:26:24.3 - NTFSx86
Running from: C:\Documents and Settings\Compaq_Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\ndiwvtoj.exe
C:\WINDOWS\system32\qeqqwqbm.dll
C:\WINDOWS\system32\unpr.sys
C:\WINDOWS\system32\vahhsbgd.dll
C:\WINDOWS\system32\vqydqfyb.dll
C:\WINDOWS\system32\wnldayii.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ndiwvtoj.exe
C:\WINDOWS\system32\qeqqwqbm.dll
C:\WINDOWS\system32\unpr.sys
C:\WINDOWS\system32\vahhsbgd.dll
C:\WINDOWS\system32\vqydqfyb.dll
C:\WINDOWS\system32\wnldayii.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))
.

2007-11-14 09:57 58,368 --a------ C:\WINDOWS\NirCmd.exe
2007-11-13 22:52 <DIR> d-------- C:\VundoFix Backups
2007-11-13 02:00 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-12 18:35 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-12 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\WINDOWS
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\Application Data\Symantec
2007-11-12 15:23 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE.000\Application Data\Intuit
2007-11-12 14:35 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE\Application Data\Symantec
2007-11-12 14:35 <DIR> d-------- C:\Documents and Settings\Administrator.JESSE\Application Data\Intuit
2007-11-11 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 17:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2007-11-08 17:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intuit
2007-11-08 17:15 <DIR> d-------- C:\temp
2007-11-08 00:14 <DIR> d-------- C:\Program Files\Nstorm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-15 01:22 914 ----a-w C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
2007-11-14 03:03 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-09 05:22 --------- d-----w C:\Program Files\Norton Internet Security
2007-11-09 04:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-09 04:50 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-09 04:50 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-09 04:50 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-09 04:50 --------- d-----w C:\Program Files\Symantec
2007-10-24 14:48 --------- d-----w C:\Program Files\Common Files\Sandlot Shared
2007-10-16 02:34 --------- d-----w C:\Documents and Settings\kelly\Application Data\Image Zone Express
2007-10-14 23:24 --------- d-----w C:\Documents and Settings\kelly\Application Data\funkitron
2007-10-13 20:45 --------- d-----w C:\Documents and Settings\kelly\Application Data\PlayFirst
2007-10-11 02:14 --------- d-----w C:\Documents and Settings\kelly\Application Data\CyberLink
2007-10-02 01:51 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-01 19:49 98,184 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-01 19:49 31,624 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-01 19:49 28,040 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-01 19:49 23,944 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-01 19:49 189,320 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-01 19:48 12,680 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-09-20 13:03 --------- d-----w C:\Program Files\LimeWire
2007-08-02 11:25 272 ----a-w C:\Documents and Settings\kelly\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((( snapshot@2007-11-14_10.16.48.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-14 14:49:52 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-11-14 19:17:48 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-11-14 14:49:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-11-14 19:17:48 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-11-14 14:49:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-11-14 19:17:49 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 16:05 C:\WINDOWS\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 22:05 C:\WINDOWS\RTHDCPL.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-09 17:50]
"nwiz"="nwiz.exe" [2006-05-09 17:50 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-23 00:14]
"PCDrProfiler"="" []
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 00:34]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 04:23]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 01:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]

C:\Documents and Settings\Administrator.JESSE.000\Start Menu\Programs\Startup\
Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-08-01 13:08:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-08-01 13:56:30]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22]

S3 samhid;samhid;C:\WINDOWS\system32\drivers\samhid.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ceb9e0e6-be98-11db-a69e-0018f3ada583}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-11-14 21:28:24 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Compaq_Owner.job"
- c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe
"2006-12-25 00:25:20 C:\WINDOWS\Tasks\Warranty Reminder 11 month.job"
- c:\windows\system32\pcintro\reminder\Warranty_Reminder_11_month\Warranty_Reminder_11_month.bat
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 12:31:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-15 12:34:21 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-14 14:21
C:\ComboFix3.txt ... 2007-11-14 10:17
.
--- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:38:50 PM, on 11/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Trend Micro\HijackThis\Kelkel.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.musiciansfriend.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://actelnet.com.1dial.com/?nocache=
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0766F5F2-BB5C-492E-A020-A83288BFDD8F}: NameServer = 205.152.37.23 205.152.144.23
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9393 bytes

Thank you

 

[Shaba]

Hi

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make sure that the following are selected:
  
  o Scan using the following Anti-Virus database:
  
  + Extended (If available otherwise Standard)
  
  o Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
  
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button
• Save the file to your desktop.
• Copy and paste that information in your next post.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Post:

- a fresh HijackThis log
- kaspersky report

 

[KELkel]

the kaspersky scan is over 280000 characters long. Still have 7 viruses and 2650 objects infected.(Virus.Win32.Virut.av). Let me know if you still want me to post it. Here is the hijack log.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:25:59 PM, on 11/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\internet explorer\iexplore.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Trend Micro\HijackThis\Kelkel.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.musiciansfriend.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://actelnet.com.1dial.com/?nocache=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://actelnet.com.1dial.com/?nocache=
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0766F5F2-BB5C-492E-A020-A83288BFDD8F}: NameServer = 205.152.37.23 205.152.144.23
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9326 bytes

 

[Shaba]

Hi

Yes I do.

You can split it into multiple replies.

 

[KELkel]

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, November 15, 2007 2:19:53 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 15/11/2007
Kaspersky Anti-Virus database records: 459936
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 83793
Number of viruses found: 7
Number of infected objects: 2650
Number of suspicious objects: 0
Duration of the scan process: 01:25:53

Infected Object Name / Virus Name / Last Action
C:\Acrobat3\Reader\AcroRd32.exe Infected: Virus.Win32.Virut.av skipped
C:\Documents and Settings\All Users\Application Data\Hewlett-Packard\HP Boot Optimizer\Setup.Exe Infected: Virus.Win32.Virut.av skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-11-15_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Application Data\U3\temp\cleanup.exe Infected: Virus.Win32.Virut.av skipped
C:\Documents and Settings\Compaq_Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Desktop\ATF-Cleaner.exe Infected: Virus.Win32.Virut.av skipped
C:\Documents and Settings\Compaq_Owner\Desktop\requested-files[2007-11-14_11_39].cab/C:/WINDOWS/system32/unpr.sys Infected: Trojan.Win32.KillAV.cn skipped
C:\Documents and Settings\Compaq_Owner\Desktop\requested-files[2007-11-14_11_39].cab CAB: infected - 1 skipped
C:\Documents and Settings\Compaq_Owner\Desktop\VundoFix.exe Infected: Virus.Win32.Virut.av skipped
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Local Settings\History\History.IE5\MSHist012007111520071116\index.dat Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Compaq_Owner\My Documents\Polar Bowler .rar/keygen.exe Infected: Trojan-Downloader.Win32.Agent.dlu skipped
C:\Documents and Settings\Compaq_Owner\My Documents\Polar Bowler .rar/crack.exe Infected: Trojan.Win32.Dialer.qn skipped
C:\Documents and Settings\Compaq_Owner\My Documents\Polar Bowler .rar/install.exe Infected: Virus.Win32.Virut.av skipped
C:\Documents and Settings\Compaq_Owner\My Documents\Polar Bowler .rar RAR: infected - 3 skipped
C:\Documents and Settings\Compaq_Owner\ntuser.dat Object is locked skipped
C:\Documents and Settings\Compaq_Owner\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\hp\bin\AddDevicePath.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\ASK.EXE Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\automod32.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\autorun.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\BlockTracker.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\CleanRec.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\cloaker.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\commands.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\ctrysel\autorun.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\DM.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\Eject.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\FindWindow.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\Finis.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\FullScreen.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\FullScreen2.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\HPBI.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\HPCONTXT.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\HPLocale.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\HtmlMsg.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\IniMerge.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\Is64OS.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\IsRunning.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\KillIt.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\KillWind.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\Locale.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\MsgAction.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\OSType.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\ProcessLogger.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\Progress.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\RefCount.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\RPCOPY.EXE Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\SendKey.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\SetIni.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\SetRes.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\Sleep.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\Spawn.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\TransientMessage.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\UIni.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\bin\wbug\CompaqPresario_Spring06.exe/WISE0015.BIN Infected: not-a-virus:AdWare.Win32.WeatherBug.a skipped
C:\hp\bin\wbug\CompaqPresario_Spring06.exe/WISE0016.BIN Infected: not-a-virus:AdWare.Win32.WeatherBug.a skipped
C:\hp\bin\wbug\CompaqPresario_Spring06.exe WiseSFX: infected - 2 skipped
C:\hp\bin\wbug\CompaqPresario_Spring06.exe WiseSFX Dropper: infected - 2 skipped
C:\hp\drivers\Agere_Soft_Modem\agrsmdel.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Agere_USB_Modem\agrsmdel.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\lan_nVidia\nvunrm.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Modem_Conexant\HXFSetup.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\Alcmtr.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\AlcWzrd.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\MicCal.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\RTHDCPL.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\RTLCPL.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\RtlUpd.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\SkyTel.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\Realtek_HD_Audio\SoundMan.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\drivers\video_nVidia_UMA\nvudisp.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\overview\fscommand\runHSC.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\PATCHES\64WW1NDR\CPC_UPD\findstr.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\PATCHES\64WW1NDR\CPC_UPD\OwnerPatch.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\PATCHES\64WW1NDR\CPC_UPD\Sleep.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\bin\PE_Patch.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\AppRecoveryLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\AppRecoveryLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\CDLogic.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\CDLogic_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\CreatorLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\CreatorLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RecordnowLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RecordnowLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RestoreLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RestoreLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RTCDLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RTCDLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RunLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\RunLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\SysRecoveryLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\SysRecoveryLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\WizardLink.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\fscommand\WizardLink_ret.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\recovery\wizard\SWR_Wizard.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\register\REGINIT.EXE Infected: Virus.Win32.Virut.av skipped
C:\hp\support\HPSysInfo.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\VINETLINK\autorun.exe Infected: Virus.Win32.Virut.av skipped
C:\hp\VINETLINK\VINETLINK.exe Infected: Virus.Win32.Virut.av skipped

 

[KELkel]

C:\Program Files\Adobe\Adobe Help Viewer\1.0\ahv.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Adobe\Reader 8.0\Reader\HowTo\ENU\version.html Infected: Worm.Win32.Mefir.p skipped
C:\Program Files\Common Files\Adobe\Help\en_US\Adobe Reader\8.0\version.html Infected: Worm.Win32.Mefir.p skipped
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriver.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriver2.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Intuit\Internet Client\assist.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_06.b05\launcher.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\patch-jre1.5.0_06.b05\zipper.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\Equation\eqnedt32.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\MSDraw\msdraw.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\Shoebox\piolch.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\WordArt\WRDART32.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WksCal.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Sonic Shared\Sonic Central\Audio\Launch.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Sonic Shared\Sonic Central\Data\Launch.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\LeaderReg.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\eengine\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Install\bwUnin.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Install\LiteInst.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\ChannelStatus.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\Infocenter.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\PrvCnt.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\register.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\RepBead.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\Restart.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\runner.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\Sprite6.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\6.3.2.116-5577497\Program\wtsisctd.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\HPCustomUninstall.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\Program\HPBWSetup\HPBWSetup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\Program\HPOOVClient.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\Program\NewProbe.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\Program\ToggleClient.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chandir.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chandir.idx Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chn.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\chn.idx Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\D0000000.FCS Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\inuse.txt Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\L0000007.FCS Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\main.log Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs.idx Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_die.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_die.idx Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_ext.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_ext.idx Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\storydb.dat Object is locked skipped
C:\Program Files\Compaq Connections\5577497\Users\Default\Data\storydb.idx Object is locked skipped
C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1\HXFSetup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Expert Software\Sonic & Knuckles Collection Documentation\Expert\Register.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\FreshGames\Word Mojo Gold\UNWISE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\del.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\delcut.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\DelFile.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\dlg.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\InfInstall2k.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\Infinstall98.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\profile\dlg.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\profile\LoadFile.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\uninstall.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Game Elements\GGE909 PC Recoil Pad\UNWISE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\SDP\BTBHost.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\SDP\HPSdpApp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\SDP\HPUpdater.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\SDP\HPWaitWindow.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\SDP\HPWriter.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Hewlett-Packard\SDP\ISPSignup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hphdel09.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hphtbl01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hposvc08.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqdirec.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqisc01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqise01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqpanos.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqpprop.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqprntw.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\HPQPSXP.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqqpawp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqtax08.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqtbx01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqusgl.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\bin\hpqvpswp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\devicemanagement\hpzmsi01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\devicemanagement\hpzscr01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\esupport\hpzmsi01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\esupport\hpzscr01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\extcapuninstall\hpzmsi01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\extcapuninstall\hpzscr01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\help\player\FlashPla.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\help\player\fscommand\D4100_load_photo.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\help\player\fscommand\D4100_paper_jam.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\help\player\fscommand\D4100_replace_cartridge.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprbui.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Product Assistant\scache\hprbhelp\hprbhelp.exe Infected: Virus.Win32.Virut.av skipped

 

[KELkel]

C:\Program Files\HP\Digital Imaging\Unload\HpqApkil.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Unload\HpqDIAS.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Unload\HpqPSmon.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Unload\HpqUnApl.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Unload\HpqUnSet.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\Unload\HpqXfer.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\hpzcdl01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\hpzsetup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\contextid.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzcdl01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzdui01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzmsi01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzpnp01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzpsl01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzrcn01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzscr01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzshl01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\DVDPlay\DVDPlay.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\DVDPlay\Koan\TouchStone.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\DVDPlay\regsvr32.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\HP Software Update\HPWUCli.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\HP Software Update\SelfUpdate.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Photosmart Essential\HP_IZE.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Photosmart Essential\photobackpluginsetup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Temp\{6A545A82-ADDA-48eb-B6D9-EB1325F1813A}\setup\hpzmsi01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Temp\{6A545A82-ADDA-48eb-B6D9-EB1325F1813A}\setup\hpzrcv01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Temp\{6A545A82-ADDA-48eb-B6D9-EB1325F1813A}\setup\hpzscr01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Temp\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzmsi01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Temp\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzrcv01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP\Temp\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzscr01.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Airstrike 2 Gulf Thunder\AirStrike3D II - Gulf.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Alien Shooter\AlienShooter.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Bejeweled 2 Deluxe\WinBej2.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Bistro Stars\BistroStars.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Blackhawk Striker 2\Blackhawk2.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Blasterball 2 Remix\bb2remix.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Blasterball 2 Revolution\bb2.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Bookworm Deluxe\BookWorm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Bounce Symphony\bounce.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Cake Mania\CakeMania.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Chuzzle Deluxe\Chuzzle.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Family Feud\FamilyFeud.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\FATE\Fate.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\FATE\help.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Insaniquarium Deluxe\Insaniquarium.scr Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Insaniquarium Deluxe\InsaniquariumDeluxe.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Insaniquarium Deluxe\WinFish_Scr.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\JEOPARDY\JEOPARDY!.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Jewel Quest\JewelQuest.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\LEGO Builder Bots\LEGO Builder Bots.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Mah Jong Quest\mahjong.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\onplay\onplay.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Penguins!\DataRepair.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Polar Bowler\Polar.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Polar Golfer\golf.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Ricochet Lost Worlds\Ricochet.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\SCRABBLE\Scrabble.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Slingo Deluxe\Slingo.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Slingo Deluxe\UNWISE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Snowy Space Trip\SpaceTrip.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Super Granny\granny.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Tradewinds\tradewinds.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\HP Games\Wheel of Fortune\Wheel of Fortune.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\Connection Wizard\isignup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\iedw.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Internet Explorer\IEXPLORE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\java.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\javacpl.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\javaw.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\javaws.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\keytool.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\kinit.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\klist.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\ktab.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\orbd.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\pack200.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\policytool.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\rmid.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\rmiregistry.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\servertool.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\tnameserv.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Java\jre1.5.0_06\bin\unpack200.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\LimeWire\LimeWire.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Messenger\msmsgs.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\mnybb.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\mnybbsvc.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\mnycopymar.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\mnyimprt.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\mnyupdate.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\msmoney.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\salv.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\Setup\uninst.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Money 2006\MNYCoreFiles\signin.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\MSWorks.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\WkDStore.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\wkgdcach.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\wklnckml.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\wkplmstp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\wksab.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\wksdb.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\WksDict.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\WksSb.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\wksss.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\WksWP.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Microsoft Works\wkwcestp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Movie Maker\moviemk.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN\MSNIA\msniasvc.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN\MSNIA\prestp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN\MsnInstaller\msninst.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN Gaming Zone\Windows\bckgzm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN Gaming Zone\Windows\hrtzzm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN Gaming Zone\Windows\Rvsezm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN Gaming Zone\Windows\shvlzm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\MSN Gaming Zone\Windows\zClientm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Musicmatch\Musicmatch Music Services\mm_TDMEngine.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Musicmatch\Musicmatch Music Services\Musicmatch Update\DLM\MMUpdateMgr.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Musicmatch\Musicmatch Music Services\Musicmatch Update\DLM\MMUpdateMgrSetup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Musicmatch\Musicmatch Music Services\Musicmatch Update\MMUpdateMgr.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Musicmatch\Musicmatch Music Services\UNWISE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\music_now\inetchk.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\music_now\mn_drop.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\NetMeeting\cb32.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\NetMeeting\conf.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\NetMeeting\wb32.exe Infected: Virus.Win32.Virut.av skipped

 

[KELkel]

C:\Program Files\Netscape\Netscape Browser\defaults\sitecontrols\updateLists.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\mangle.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\netscape.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\rebasedlls.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\regchrome.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\regxpcom.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\res\samples\test_ed.html Infected: Worm.Win32.Mefir.p skipped
C:\Program Files\Netscape\Netscape Browser\RunCmdFile.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\shlibsign.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\xpcshell.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\xpicleanup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\xpidl.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\xpt_dump.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Netscape\Netscape Browser\xpt_link.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0123NAV~.TMP Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0530NAV~.TMP Object is locked skipped
C:\Program Files\Nstorm\ElfBowl.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Nstorm\Uninstall.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\Canada\comps\flash\FlashAX.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\Canada\comps\rp\RealPl8.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\Canada\comps\rp\real_upd.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\Canada\comps\rp\rp9codec.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\Canada\comps\vwpt\VPPrePop.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\InstallAol.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90\AOLSETUP.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90\COMPS\COACH\AOLCINST.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90\COMPS\FLASH\FLASHAX.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90\COMPS\RP\REALPL8.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90\COMPS\RP\REAL_UPD.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90\COMPS\RP\RP9CODEC.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90\COMPS\VWPT\VPPREPOP.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\AOL90E\AOLSETUP.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Aol\United States\LANGPICK.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Canada\KOL\comps\flash\FlashAX.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Canada\KOL\comps\rp\RealPl8.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Canada\KOL\comps\rp\real_upd.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Canada\KOL\comps\rp\rp9codec.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\Canada\KOL\comps\vwpt\VPPrePop.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\EarthLink\InstallEarthLink.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\eBay\WizLink.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\MSN90\LaunchMsn.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\NetscapeOnline\Netscape Tech\webutil8.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\NetscapeOnline\Netscape Tech\WinsockFix.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\BartShel.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\Bin\PPCOLink.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\Browser\BartShel.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\Browser\PPShared.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\HPPeoplePC.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\IE\EN\ie6setup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Dialer\dialer.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\CLOSEIE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\IEDownload.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\ISP50\Bin\BartShel.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\ISP50\Bin\FireWall.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\ISP50\Bin\PPCOLink.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\ISP50\Bin\PPShared.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\CLOSEIE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\PopWait.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\PPCOUNIN.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\PPCRunOnce.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\RasWait.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\RegHero.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\SetPop3.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\System\unPPC.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Utilities\AtlBrowser.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Utilities\DLocations.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Utilities\EULA.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Utilities\NAVWarn.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Utilities\PPCODIAG.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\ISP5900\Utilities\PPCODUN.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\Setup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\PopWait.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\PPCInfo.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\PPCOUNIN.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\RegHero.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\unACC.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\unMAX.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\unPPC.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\System\unPPC6000.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\Utilities\PPCODUN.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\PeoplePC\Utilities\PPCRestore.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Online Services\zipca\WizLink.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Outlook Express\msimn.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Outlook Express\oemig50.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Outlook Express\setup50.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Outlook Express\wab.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Outlook Express\wabmig.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\drivers\LANPKT\i386\InstallDriver.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\drivers\LANPKT\i386\sc.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\drivers\usbdongle\x64\install64.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\IsProcessActive.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\PCBEEP.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\pcdr5cuiw32.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\pcdrbootablecd.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\PcdrEngine.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\pcdrexdx.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\PCDrNDISUIOInstaller.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\PC-Doctor 5 for Windows\xjre\bin\cleanup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\bagent.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\billmind.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\BindContent.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\olbackup.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\PDFDrv\Install.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\printenv.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\qhi.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\qw.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\RestartExe.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\START.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Quicken\techhelp.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Solitaire\solitaire.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Sonic\Express Labeler 2\stax.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Trend Micro\HijackThis\Kelkel.exe.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\WildTangent\Apps\CDA\wtControlPanel.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\WildTangent\Apps\My HP Game Console\GameConsole.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Connect 2\wmccds.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Connect 2\WMCCFG.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\migrate.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\mplayer2.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\setup_wm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmdbexport.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmlaunch.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmpenc.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmplayer.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmpnetwk.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmpnscfg.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmpshare.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows Media Player\wmsetsdk.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows NT\Accessories\wordpad.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows NT\dialer.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows NT\hypertrm.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Windows NT\Pinball\PINBALL.EXE Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Z-Ball Free Trial\Z-Ball.exe Infected: Virus.Win32.Virut.av skipped
C:\Program Files\Z-Ball Free Trial\zb.exe Infected: Virus.Win32.Virut.av skipped
C:\Python22\Lib\site-packages\pythonwin\Pythonwin.exe Infected: Virus.Win32.Virut.av skipped
C:\Python22\Lib\site-packages\win32\pythonservice.exe Infected: Virus.Win32.Virut.av skipped
C:\Python22\Lib\site-packages\win32\win32popenWin9x.exe Infected: Virus.Win32.Virut.av skipped
C:\Python22\python.exe Infected: Virus.Win32.Virut.av skipped
C:\Python22\pythonw.exe Infected: Virus.Win32.Virut.av skipped
C:\Python22\Removepywin32.exe Infected: Virus.Win32.Virut.av skipped
C:\Python22\UNWISE.EXE Infected: Virus.Win32.Virut.av skipped
C:\Python22\w9xpopen.exe Infected: Virus.Win32.Virut.av skipped

 

[KELkel]

C:\qoobox\Hiv-backup\ERDNT.EXE Infected: Virus.Win32.Virut.av skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\csrs.exe.vir Infected: Virus.Win32.Virut.av skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\firewall.exe.vir Infected: Virus.Win32.Virut.av skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\iexplore.exe.vir Infected: Virus.Win32.Virut.av skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\khffefc.dll.vir Infected: Trojan-Downloader.Win32.Agent.dlu skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\ndiwvtoj.exe.vir Infected: Virus.Win32.Virut.av skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\unpr.sys.vir Infected: Trojan.Win32.KillAV.cn skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\wnldayii.dll.vir Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\qoobox\Quarantine\catchme2007-11-14_101508.29.zip/khffefc.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped
C:\qoobox\Quarantine\catchme2007-11-14_101508.29.zip/khffefc.dll.1 Infected: Trojan-Downloader.Win32.Agent.dlu skipped
C:\qoobox\Quarantine\catchme2007-11-14_101508.29.zip ZIP: infected - 2 skipped
C:\SEGA\Sonic3K\RUNSONIC.EXE Infected: Virus.Win32.Virut.av skipped
C:\StubInstaller.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP326\A0067408.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP326\A0067410.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP326\A0067411.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP326\A0067415.scr Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP326\A0067416.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP326\A0067418.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067421.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067423.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067424.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067425.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067426.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067427.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067428.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067429.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067430.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067431.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067432.EXE Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067433.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067434.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067435.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067436.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067437.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067438.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067439.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067440.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067447.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067448.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067449.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067450.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067451.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067455.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067458.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067461.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067462.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067464.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067465.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067466.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067467.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067468.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067469.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067470.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067472.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067473.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067474.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067476.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067478.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067479.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067480.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067481.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067482.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067483.scr Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067486.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067488.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067490.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067491.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067492.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067493.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067494.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067495.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067496.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067497.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067551.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067552.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067561.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067564.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067565.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067566.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067567.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067568.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067569.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067570.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067573.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067574.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067575.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067576.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067577.EXE Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067578.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067580.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067599.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067601.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067610.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067611.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP327\A0067612.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067613.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067614.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067616.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067617.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067618.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067619.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067620.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067621.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067622.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067623.EXE Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067624.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067625.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067626.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067627.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067628.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067629.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067630.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067631.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067632.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067633.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067634.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067635.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067636.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067642.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067643.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067644.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067650.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067651.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067653.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067657.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067658.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067659.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067660.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067664.exe Infected: Virus.Win32.Virut.av skipped
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP328\A0067665.dll Infected: Trojan-Downloader.Win32.Agent.dlu skipped