[Rorschach112]

Ok looking good

Try get MBAM or Kaspersky to run

Tell me how your PC is running after that

[Advertisements]

Kaspersky is scanning My Computer right now
It's gonna take a while
It found 1 viruses already

[Sapphire85]

Kaspersky is scanning My Computer right now
It's gonna take a while
It found 1 viruses already

[Rorschach112]

Ok perfect, let me know when it is done

[Sapphire85]

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, April 25, 2008 2:41:14 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/04/2008
Kaspersky Anti-Virus database records: 725262
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 137610
Number of viruses found: 5
Number of infected objects: 125
Number of suspicious objects: 0
Duration of the scan process: 03:35:07

Infected Object Name / Virus Name / Last Action
C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-04-25_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Tri487\liveupdt.tri Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Log.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A97573A.exe Infected: Worm.Win32.Perlovga.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\36E2B7D4.TMP Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\FDA8A4D1.TMP Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Nuni\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped
C:\Documents and Settings\Nuni\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Nuni\Desktop\Grey's Anatomy S3\Greys.Anatomy.S04E12.HDTV.XViD-DOT.avi.bc! Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\History\History.IE5\MSHist012008042520080426\index.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\Perflib_Perfdata_5fc.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\Perflib_Perfdata_880.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\Perflib_Perfdata_f0c.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DF2923.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DF2930.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DF3F7A.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DF4CCD.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DF4D0A.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DFC461.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DFFD88.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temp\~DFFDC7.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso516.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso517.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso518.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso519.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso51A.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso51B.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso51C.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso51D.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso51E.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.MSO\mso51F.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.Word\~WRS{26B147FC-117D-487D-8856-A20C4517E9C2}.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.Word\~WRS{AE4972E2-24DF-494C-9FC4-831BCAE6BB89}.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.Word\~WRS{E001BADC-0FE5-4975-8918-37EF6E905B9C}.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.Word\~WRS{E33EFA90-ECEA-437F-8005-5F01FE1FB473}.tmp Object is locked skipped
C:\Documents and Settings\Nuni\Local Settings\Temporary Internet Files\Content.Word\~WRS{E5BEE7CE-6C9F-4B2C-8562-28C52870F134}.tmp Object is locked skipped
C:\Documents and Settings\Nuni\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Nuni\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\eengine\EPERSIST.DAT Object is locked skipped
C:\Program Files\Ela-Salaty\Salaty.abs Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\WebMediaPlayer\uninst.exe.vir/stream/data0002 Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\QooBox\Quarantine\C\Program Files\WebMediaPlayer\uninst.exe.vir/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\QooBox\Quarantine\C\Program Files\WebMediaPlayer\uninst.exe.vir NSIS: infected - 2 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\amvo0.dll.vir Infected: Trojan-PSW.Win32.OnLineGames.qms skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\fool0.dll.vir Infected: Worm.Win32.AutoRun.ddj skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kxvo.exe.vir Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP412\A0053985.dll Infected: Trojan-PSW.Win32.OnLineGames.qms skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP412\A0053994.dll Infected: Trojan-PSW.Win32.OnLineGames.qms skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP413\A0054039.dll Infected: Trojan-PSW.Win32.OnLineGames.qms skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP413\A0054075.dll Infected: Trojan-PSW.Win32.OnLineGames.qms skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP414\A0054125.exe Infected: Trojan-PSW.Win32.OnLineGames.qks skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP453\A0062942.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP453\A0062943.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP455\A0063110.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP455\A0063111.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP455\A0063168.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP455\A0063169.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP455\A0063178.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP455\A0063179.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063205.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063206.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063560.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063561.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063847.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063848.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063866.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP456\A0063867.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP458\A0064886.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP458\A0064887.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP460\A0064923.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP460\A0064924.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP460\A0064934.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP460\A0064935.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP461\A0065093.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP461\A0065094.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP461\A0065855.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP461\A0065856.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP462\A0066389.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP462\A0066390.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP462\A0067500.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP462\A0067501.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP463\A0068066.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP463\A0068067.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP463\A0069839.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP463\A0069840.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP465\A0070313.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP465\A0070314.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP465\A0072408.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP465\A0072409.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP466\A0072416.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP466\A0072417.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP466\A0076497.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP466\A0076498.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076844.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076845.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076852.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076853.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076862.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076863.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076872.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP469\A0076873.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP470\A0077010.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP470\A0077011.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP472\A0077018.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP472\A0077019.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP472\A0077285.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP472\A0077286.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP474\A0077700.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP474\A0077701.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP474\A0078058.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP474\A0078059.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP479\A0078381.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP479\A0078382.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP481\A0078539.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP481\A0078540.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP481\A0078976.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP481\A0078977.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP484\A0079311.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP484\A0079312.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP485\A0079321.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP485\A0079322.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP485\A0079343.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP485\A0079344.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP487\A0079463.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP487\A0079464.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP488\A0079475.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP488\A0079476.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP488\A0079668.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP488\A0079669.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP491\A0080563.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP491\A0080564.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP492\A0080569.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP492\A0080570.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP492\A0081032.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP492\A0081033.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP493\A0081038.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP493\A0081039.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP493\A0082040.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP493\A0082041.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP494\A0082046.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP494\A0082047.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP494\A0082574.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP494\A0082575.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP495\A0082956.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP495\A0082957.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP499\A0083684.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP499\A0083685.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP500\A0084093.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP500\A0084094.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP502\A0084513.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP502\A0084514.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP503\A0084696.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP503\A0084697.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP503\A0085129.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP503\A0085130.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP504\A0085151.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP504\A0085152.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP505\A0085221.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP505\A0085221.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP505\A0085221.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP505\A0085222.dll Infected: Trojan-PSW.Win32.OnLineGames.qms skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP507\A0085537.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP507\A0085538.exe Infected: Worm.Win32.AutoRun.ddj skipped
C:\System Volume Information\_restore{487C2D6B-A66C-4218-9702-64B1A79A9751}\RP510\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{F7F07FC9-D733-4E1E-B0C0-BE45880221AC}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\ieso0.dll Infected: Worm.Win32.AutoRun.ddj skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[Rorschach112]

Hello

Please download Navilog1 by IL-MAFIOSO:
http://pagesperso-or...ix/Navilog1.exe
(*Alternate download location Here)

* Save it to your Desktop.
* Double-click on Navilog1.exe to install the program.
* When the installation is complete, the tool will start automatically.
* If it doesn't start automatically, please double-click on the Navilog1 shortcut on your Desktop to run it.
* Press E for English from the language Menu.
* Type 1 in the next Menu to select Search and press Enter.
* Wait for the Scan to finish (It may take a reasonable amount of time).
* Press any key as requested .
* A new document will be produced: fixnavi.txt.
* Please copy/paste the contents of this report in your next reply.

The report is also saved in the root of the directory, "%SystemDrive%\fixnavi.txt". (usually C:\fixnavi.txt)



Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  [kill explorer]
  C:\WINDOWS\system32\ieso0.dll
  purity 
  [start explorer]

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
• Click the red Moveit! button.
• A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Also tell me how your PC is running

[Sapphire85]

Search Navipromo version 3.5.4 began on Fri 04/25/2008 at 14:50:23.54

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Program Files\navilog1
Actual User Account : "Nuni"

Updated on 15.04.2008 at 18h00 by IL-MAFIOSO


Microsoft Windows XP [Version 5.1.2600]
Version Internet Explorer : 7.0.5730.11
Filesystem type : NTFS

Done in normal mode

*** Searching for installed Software ***




*** Search folders in "C:\WINDOWS" ***



*** Search folders in "C:\Program Files" ***



*** Search folders in "C:\DOCUME~1\ALLUSE~1\APPLIC~1" ***




*** Search folders in "C:\Documents and Settings\Nuni\applic~1" ***



*** Search folders in "C:\Documents and Settings\Nuni\locals~1\applic~1" ***



*** Search folders in "C:\Documents and Settings\Nuni\startm~1\programs" ***


*** Search folders in "C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs" ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

No file found



*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\WINDOWS\system32" *

* Scan in "C:\Documents and Settings\Nuni\locals~1\applic~1" *



*** Search files ***




*** Search specific Registry keys ***


*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :


2)Heuristic Search :

* In "C:\WINDOWS\system32" :


* In "C:\Documents and Settings\Nuni\locals~1\applic~1" :


3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate not found !
OOO-Favorit certificate not found !
Sunny-Day-Design-Ltd certificate not found !

4)Search known files :



*** Search completed on Fri 04/25/2008 at 14:59:42.59 ***





Explorer killed successfully
LoadLibrary failed for C:\WINDOWS\system32\ieso0.dll
C:\WINDOWS\system32\ieso0.dll NOT unregistered.
C:\WINDOWS\system32\ieso0.dll moved successfully.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04252008_151715



It's slower than before

[Rorschach112]

Your logs are clean ! We need to do a few things

Follow these steps to uninstall Combofix and tools used in the removal of malware

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  

Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com.../readstep2.html



You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here

• Make sure you have an Internet Connection.
• Double-click OTMoveIt2.exe to run it.
• Click on the CleanUp! button
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
• Click Yes to beging the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

[Sapphire85]

I can' thank you enough for your time and help
You know if I took my computer to someone here (in Saudi Arabia), the only solution they would have is to format it
I really appreciate what you've done

I have two more questions:
1/ OTMoveIt2.exe would get stuck everytime I would click on the CleanUp! button, how can that be fixed?
2/ The information in the logs I have posted, are they important information that can harm me if someone gets a hold of it ?

Edited by Sapphire85, 25 April 2008 - 07:45 AM.

[Rorschach112]

Hello

1/ OTMoveIt2.exe would get stuck everytime I would click on the CleanUp! button, how can that be fixed?

Just delete OTMoveIt2.exe and the other tools we used then

2/ The information in the logs I have posted, are they important information that can harm me if someone gets a hold of it ?

Nope they are perfectly safe, there is no information there that can be used against you


Anything else ?

[Sapphire85]

Nope

Thank you again

[Rorschach112]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.