Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

kxvo.exe PLEASE HELP [RESOLVED]

Started by amm007 , Mar 05 2008 08:19 AM

This topic is locked

#106
amm007

Posted 04 April 2008 - 08:00 PM

Member

Topic Starter
Member
265 posts

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, April 05, 2008 9:58:25 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/04/2008
Kaspersky Anti-Virus database records: 682361
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 53475
Number of viruses found: 9
Number of infected objects: 106
Number of suspicious objects: 0
Duration of the scan process: 02:06:49

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masdata.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masevents.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\SpamKiller\Logs\Filtering.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd002.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\cert8.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\history.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\key3.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\parent.lock Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\MSHist012008040520080406\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\Perflib_Perfdata_84c.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Ruberc\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP2\A0000341.dll.mwt Infected: Packed.Win32.PolyCrypt.h skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP2\A0000367.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP2\A0000422.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP2\A0000423.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP2\A0000424.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP3\A0000428.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP3\A0000592.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP3\A0000593.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP3\A0000594.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000618.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000619.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000620.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000638.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000639.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000640.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000671.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000672.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000676.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000687.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000688.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000689.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000700.cmd Infected: Packed.Win32.PolyCrypt.h skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000709.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000710.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000711.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000736.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000765.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000766.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000768.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000778.dll Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000779.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000780.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000787.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000788.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000798.dll Infected: Trojan-PSW.Win32.OnLineGames.yya skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000799.dll Infected: Trojan-PSW.Win32.OnLineGames.yrf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000800.cmd Infected: Trojan.Win32.Vaklik.yf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000804.exe Infected: Trojan.Win32.Vaklik.yf skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000818.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000820.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000829.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000830.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000834.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000842.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000843.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000844.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000854.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000855.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000856.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000866.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000867.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000869.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000888.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000916.exe Infected: Worm.Win32.AutoRun.dem skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000921.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000922.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000923.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000932.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000933.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000935.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000949.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000950.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000951.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000961.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000962.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000963.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000972.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000973.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000975.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000988.dll Infected: Trojan-PSW.Win32.OnLineGames.ywu skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000989.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000990.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000997.exe Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000998.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0001011.cmd Infected: Worm.Win32.AutoRun.dfc skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0001012.dll Infected: Worm.Win32.AutoRun.dfd skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0001015.exe Infected: Trojan.Win32.Vaklik.yl skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP8\A0001252.bat Infected: Trojan.Win32.Vaklik.yl skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP8\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\sqlite_2m1mmbhXaLVMuqA Object is locked skipped
C:\WINDOWS\Temp\sqlite_J3w0vwFdwHEnjH4 Object is locked skipped
C:\WINDOWS\Temp\sqlite_o6Z6m9mAxMiyWeP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP2\A0000426.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP3\A0000430.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP3\A0000596.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000622.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000642.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000678.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000691.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000703.cmd Infected: Packed.Win32.PolyCrypt.h skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP4\A0000713.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000738.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000770.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000782.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000802.cmd Infected: Trojan.Win32.Vaklik.yf skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000822.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000836.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000846.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000858.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP5\A0000871.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000890.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000917.exe Infected: Worm.Win32.AutoRun.dem skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000925.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000937.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000953.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000965.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000977.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP6\A0000992.cmd Infected: Worm.Win32.AutoRun.dfc skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP8\A0001253.bat Infected: Trojan.Win32.Vaklik.yl skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP8\A0001254.cmd Infected: Worm.Win32.AutoRun.dfc skipped

Scan process completed.

#107
kahdah

Posted 05 April 2008 - 06:24 AM

GeekU Teacher

Retired Staff
15,822 posts

FInally we are getting somewhere

=========================
Let's try to remove thoise restore points again.

I will need you to reset your System Restore points, please note that you will need to log into your computer with an account which has full administrator access.
You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.
Click on *Start
Right-click *My Computer
Click *Properties
Click the *System Restore tab
Check *Turn off System Restore
Click *Apply, and then click *OK.

2. Reboot.

3. Turn ON System Restore.
Click on *Start
Right-click *My Computer
Click *Properties
*UN-Check *Turn off System Restore*
Check *Turn on System Restore
Click *Apply, and then click *OK.

How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us
===================================================================
After that you might want to rescan these folders with kaspersky just to see if it is actually gone:
C:\System Volume Information
D:\System Volume Information

Post back and let me know how things are running?
ANd also the results of the last scan after clearing the restore points.

Edited by kahdah, 05 April 2008 - 06:24 AM.
typo

#108
amm007

Posted 05 April 2008 - 08:58 PM

Member

Topic Starter
Member
265 posts

It would be helpful to tell the Yahoo Messenger error is connected to the virus. Computer 1, after being disinfected, is now able to use the Yahoo Messenger. Whenever we use utilities to erase the viruses, the Yahoo Messenger is functional. As for computer 2, it is still infected evident by the malfunction of Yahoo Messenger and the Kaspersky Scan. Also, I would like to restate that Mozilla used to append .com to addresses typed in the address bar. When I type Yahoo, it is redirected to yahoo.com. But now, it is directed to download some application file. Particularly, Mozilla specifies it as application/x-httpd-php file. How could we completely eradicate these infections? Thanks!

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, April 06, 2008 10:49:55 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 5/04/2008
Kaspersky Anti-Virus database records: 685569
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 52720
Number of viruses found: 3
Number of infected objects: 4
Number of suspicious objects: 0
Duration of the scan process: 01:04:52

Infected Object Name / Virus Name / Last Action
C:\dhv2u8.cmd Infected: Trojan.Win32.Vaklik.yf skipped
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masdata.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masevents.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\SpamKiller\Logs\Filtering.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd000.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\cert8.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\history.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\key3.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\parent.lock Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\MSHist012008040620080407\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\8lm5ns.dll Infected: Trojan-PSW.Win32.OnLineGames.zkb skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Ruberc\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{FAB0E3CA-4F6B-47C7-9CED-77BBE6AB3AAC}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\fool0.dll Infected: Worm.Win32.AutoRun.dgi skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\sqlite_PiNyGESXDZDfX88 Object is locked skipped
C:\WINDOWS\Temp\sqlite_RtLvSJaSnVp3VxU Object is locked skipped
C:\WINDOWS\Temp\sqlite_ysIjvrUVxw4Wy4b Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\dhv2u8.cmd Infected: Trojan.Win32.Vaklik.yf skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\change.log Object is locked skipped

Scan process completed.

#109
kahdah

Posted 05 April 2008 - 09:15 PM

GeekU Teacher

Retired Staff
15,822 posts

Try this online scanner.
BitDefender
post that log and a new Hijackthis log.

Also can you tell me the name of the file that you are getting redirected to?

#110
amm007

Posted 06 April 2008 - 03:34 AM

Member

Topic Starter
Member
265 posts

The file redirected to is unnamed. There is no (untitled) indicated but maybe a space or a null character is used. All Mozilla's giving is the application/x-httpd-php type of file. It substitutes for all addresses redirected to page cannot be found. I'll try that scan though. Is it comaptible with mozilla or do I have to use internet explorer? Thank you!

#111
amm007

Posted 06 April 2008 - 05:34 AM

Member

Topic Starter
Member
265 posts

In computer 1, here's scan results for bitdefender. I'll post the scan results for computer 2 soon.
BitDefender Online Scanner

Scan report generated at: Sun, Apr 06, 2008 - 19:09:59

Scan path: C:\Documents and Settings\Adrian\My Documents;C:\Documents and Settings\All Users\Documents;A:\;C:\;D:\;E:\;G:\;C:\Documents and Settings\Adrian\My Documents;C:\Documents and Settings\Adrian\Desktop\Gipsy Kings;C:\Documents and Settings\Adrian\Desktop\mommy's files;C:\Documents and Settings\Adrian\Desktop\natsci_temp;C:\Documents and Settings\Adrian\Desktop\samsung backup;C:\Documents and Settings\Adrian\Desktop\shutdown;C:\Documents and Settings\Adrian\Desktop\Sigsheet;

Statistics

Time

00:45:15

Files

255140

Folders

6549

Boot Sectors

4

Archives

1652

Packed Files

13379

Results

Identified Viruses

1

Infected Files

2

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

2

Engines Info

Virus Definitions

1128814

Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins

16

Archive plugins

41

Unpack plugins

7

E-mail plugins

6

System plugins

5

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

G:\My Documents2\Adrian's Folder\Heart Game.exe

Detected with: Application.Joke.Ultimate.A

G:\My Documents2\Adrian's Folder\Heart Game.exe

Disinfection failed

G:\My Documents2\Adrian's Folder\Heart Game.exe

Deleted

G:\System Volume Information\_restore{98E32788-62AF-4CAA-9CE2-F5CBD86C4D5A}\RP5\A0003412.exe

Detected with: Application.Joke.Ultimate.A

G:\System Volume Information\_restore{98E32788-62AF-4CAA-9CE2-F5CBD86C4D5A}\RP5\A0003412.exe

Disinfection failed

G:\System Volume Information\_restore{98E32788-62AF-4CAA-9CE2-F5CBD86C4D5A}\RP5\A0003412.exe

Deleted

#112
amm007

Posted 06 April 2008 - 07:43 AM

Member

Topic Starter
Member
265 posts

BitDefender Online Scanner

Scan report generated at: Sun, Apr 06, 2008 - 21:27:34

Scan path: C:\Documents and Settings\Ruberc\Phone Browser;::{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D};C:\Documents and Settings\Ruberc\My Documents;C:\Documents and Settings\russ\My Documents;C:\Documents and Settings\All Users\Documents;C:\;D:\;E:\;

Statistics

Time

00:52:38

Files

113233

Folders

5608

Boot Sectors

3

Archives

1302

Packed Files

5006

Results

Identified Viruses

3

Infected Files

7

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

7

Engines Info

Virus Definitions

1128814

Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins

16

Archive plugins

41

Unpack plugins

7

E-mail plugins

6

System plugins

5

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

C:\dhv2u8.cmd

Infected with: Packer.Malware.NSAnti.X

C:\dhv2u8.cmd

Disinfection failed

C:\dhv2u8.cmd

Deleted

C:\Documents and Settings\Ruberc\Local Settings\Temp\8lm5ns.dll

Infected with: Packer.Malware.NSAnti.AA

C:\Documents and Settings\Ruberc\Local Settings\Temp\8lm5ns.dll

Disinfection failed

C:\Documents and Settings\Ruberc\Local Settings\Temp\8lm5ns.dll

Deleted

C:\Documents and Settings\Ruberc\Local Settings\Temp\udtas9b.dll

Infected with: Packer.Malware.NSAnti.X

C:\Documents and Settings\Ruberc\Local Settings\Temp\udtas9b.dll

Disinfection failed

C:\Documents and Settings\Ruberc\Local Settings\Temp\udtas9b.dll

Deleted

C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000016.dll

Infected with: Packer.Malware.NSAnti.AA

C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000016.dll

Disinfection failed

C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000016.dll

Deleted

C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000052.cmd

Infected with: Packer.Malware.NSAnti.X

C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000052.cmd

Disinfection failed

C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000052.cmd

Deleted

D:\dhv2u8.cmd

Infected with: Packer.Malware.NSAnti.X

D:\dhv2u8.cmd

Disinfection failed

D:\dhv2u8.cmd

Deleted

D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000053.cmd

Infected with: Packer.Malware.NSAnti.X

D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000053.cmd

Disinfection failed

D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\A0000053.cmd

Deleted

#113
kahdah

Posted 06 April 2008 - 08:07 AM

GeekU Teacher

Retired Staff
15,822 posts

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
[kill explorer]
C:\WINDOWS\system32\fool0.dll 
[start explorer]
```
Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
Click the red Moveit! button.
OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
==================================
I will need you to reset your System Restore points.
1. Turn off System Restore.
Click on *Start
Right-click *My Computer
Click *Properties
Click the *System Restore tab
Check *Turn off System Restore
Click *Apply, and then click *OK.

2. Reboot.

3. Turn ON System Restore.
Click on *Start
Right-click *My Computer
Click *Properties
*UN-Check *Turn off System Restore*
Check *Turn on System Restore
Click *Apply, and then click *OK.

How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us
=======================================================================
Please do an online scan with Kaspersky WebScanner
(This scanner is for use with internet explorer only)
Click on "Accept"

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

#114
amm007

Posted 06 April 2008 - 08:40 AM

Member

Topic Starter
Member
265 posts

File/Folder [kill explorer] not found.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\fool0.dll
C:\WINDOWS\system32\fool0.dll NOT unregistered.
C:\WINDOWS\system32\fool0.dll moved successfully.
File/Folder [start explorer] not found.

OTMoveIt2 v1.0.21 log created on 04062008_223859

#115
amm007

Posted 06 April 2008 - 10:22 AM

Member

Topic Starter
Member
265 posts

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, April 07, 2008 12:21:11 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 6/04/2008
Kaspersky Anti-Virus database records: 686632
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 53224
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:05:21

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masdata.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masevents.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\SpamKiller\Logs\Filtering.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd000.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\cert8.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\history.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\key3.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\parent.lock Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Desktop\Physics Handouts.doc Object is locked skipped
C:\Documents and Settings\Ruberc\Desktop\~WRL0004.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\MSHist012008040620080407\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\~DF10BA.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\~DF10E0.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\~DF287D.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\~WRS0001.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Ruberc\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{65B42031-6B4C-4108-B096-7243099FE9E1}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\sqlite_FiKf7uH0qshDAI8 Object is locked skipped
C:\WINDOWS\Temp\sqlite_QnrXpn9iz6p6jRt Object is locked skipped
C:\WINDOWS\Temp\sqlite_RZHS9CYGGkl2xBA Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\change.log Object is locked skipped

Scan process completed.

#116
kahdah

Posted 06 April 2008 - 03:55 PM

GeekU Teacher

Retired Staff
15,822 posts

Are you still having the file download prompts?

I would like for you to reboot a few times.
See if anything changes then in a bit run Kaspersky again and we will see if it comes back.

#117
amm007

Posted 06 April 2008 - 08:03 PM

Member

Topic Starter
Member
265 posts

Yes I still encounter the filed download prompts for pages which are inexistent or cannot be found. I'll soon try scanning again with kaspersky to see if its coming back.

#118
amm007

Posted 06 April 2008 - 09:19 PM

Member

Topic Starter
Member
265 posts

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, April 07, 2008 11:17:49 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 7/04/2008
Kaspersky Anti-Virus database records: 687522
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 52835
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:06:45

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masdata.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\AntiSpyware\Data\masevents.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\SpamKiller\Logs\Filtering.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd001.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\cert8.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\history.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\key3.db Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\parent.lock Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Ruberc\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Desktop\NEW REVISED HANDBOOK.doc Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Application Data\Mozilla\Firefox\Profiles\fxb8jhig.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\History\History.IE5\MSHist012008040720080408\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\~DF6865.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\~DF8D6F.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temp\~WRC0000.tmp Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Ruberc\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ruberc\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Ruberc\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{EB978221-F46D-4D10-81ED-5B1DE1121FE9}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\sqlite_1yKM33ooIqOry2m Object is locked skipped
C:\WINDOWS\Temp\sqlite_d6wxTtpTSprKdY2 Object is locked skipped
C:\WINDOWS\Temp\sqlite_WIf82gxk5HiycEg Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{A0515764-FCD7-49DF-B1A0-2AC466CD1313}\RP1\change.log Object is locked skipped

Scan process completed.

#119
kahdah

Posted 07 April 2008 - 03:10 AM

GeekU Teacher

Retired Staff
15,822 posts

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
===============================================================
Please run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!

Follow the Instruction Here for installation.
Accept the License Agreement.
Once the ActiveX installs,Click Full System Scan
Once the download completes,the scan will begin automatically.
The scan will take some time to finish,so please be patient.
When the scan completes, click the Automatic cleaning (recommended) button.
Click the Show Report button and Copy&Paste the entire report in your next reply.