Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

WinFixer & JKill & Vundo Problems [RESOLVED]


  • This topic is locked This topic is locked

#16
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
    C:\WINDOWS\system32\vxkclvkc.dll
    C:\WINDOWS\system32\epqsbqhc.dll
    C:\pwrcmdr
    C:\WINDOWS\system32\rcjqkhwo.dll
    C:\WINDOWS\system32\gsbmliqf.dll
    C:\WINDOWS\system32\scvtxqvj.dll
    C:\WINDOWS\system32\iqswqqsx.dll
    C:\WINDOWS\system32\iukylajj.dll
    C:\WINDOWS\system32\rfehqxnh.dll
    C:\WINDOWS\system32\BKlUCJjl.ini2
    C:\WINDOWS\system32\CLnonnpo.ini2
    C:\WINDOWS\system32\oyuobdhx.dll
    C:\WINDOWS\system32\fjulomwo.dll
    C:\WINDOWS\system32\onUFPqru.ini2
    purity 
    EmptyTemp
    [start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


Reboot and post a new DSS log
  • 0

Advertisements


#17
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
Here is the OTMoveit2 log

Explorer killed successfully
LoadLibrary failed for C:\WINDOWS\system32\vxkclvkc.dll
C:\WINDOWS\system32\vxkclvkc.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vxkclvkc.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\epqsbqhc.dll
C:\WINDOWS\system32\epqsbqhc.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\epqsbqhc.dll scheduled to be moved on reboot.
C:\pwrcmdr moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\rcjqkhwo.dll
C:\WINDOWS\system32\rcjqkhwo.dll NOT unregistered.
C:\WINDOWS\system32\rcjqkhwo.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\gsbmliqf.dll
C:\WINDOWS\system32\gsbmliqf.dll NOT unregistered.
C:\WINDOWS\system32\gsbmliqf.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\scvtxqvj.dll
C:\WINDOWS\system32\scvtxqvj.dll NOT unregistered.
C:\WINDOWS\system32\scvtxqvj.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\iqswqqsx.dll
C:\WINDOWS\system32\iqswqqsx.dll NOT unregistered.
C:\WINDOWS\system32\iqswqqsx.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\iukylajj.dll
C:\WINDOWS\system32\iukylajj.dll NOT unregistered.
C:\WINDOWS\system32\iukylajj.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\rfehqxnh.dll
C:\WINDOWS\system32\rfehqxnh.dll NOT unregistered.
C:\WINDOWS\system32\rfehqxnh.dll moved successfully.
C:\WINDOWS\system32\BKlUCJjl.ini2 moved successfully.
C:\WINDOWS\system32\CLnonnpo.ini2 moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\oyuobdhx.dll
C:\WINDOWS\system32\oyuobdhx.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\oyuobdhx.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\fjulomwo.dll
C:\WINDOWS\system32\fjulomwo.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\fjulomwo.dll scheduled to be moved on reboot.
C:\WINDOWS\system32\onUFPqru.ini2 moved successfully.
< purity >
< EmptyTemp >
Temp folders emptied.
IE temp folders emptied.
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 06282008_133141

Files moved on Reboot...
File C:\WINDOWS\system32\vxkclvkc.dll not found!
File C:\WINDOWS\system32\epqsbqhc.dll not found!
File C:\WINDOWS\system32\oyuobdhx.dll not found!
File C:\WINDOWS\system32\fjulomwo.dll not found!



Here is the DSS log






Deckard's System Scanner v20071014.68
Run by Owner on 2008-06-28 13:52:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 76% (more than 75%).
Total Physical Memory: 448 MiB (512 MiB recommended).


-- HijackThis (run as Owner.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:41 PM, on 6/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symante Shared\ccApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\SIERRA\CardStudio\PLNRnote.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Documents and Settings\Owner\Desktop\dssdeckerds.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h...a...&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.c...a...&tbid=61008
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cme.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.c...spx?tb_id=61008
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.c...aspx?TbId=61008
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.c...spx?tb_id=61008
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.c...aspx?TbId=61008
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.h...a...&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.cme.com/"); (C:\Documents and Settings\OWNER\Application Data\Mozilla\Profiles\default\po3pew71.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\OWNER\Application Data\Mozilla\Profiles\default\po3pew71.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Worms2.exe] C:\DOCUME~1\Josiah\MYDOCU~1\MYVIDE~1\WORMS2~1.EXE /r
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = C:\Program Files\SIERRA\CardStudio\PLNRnote.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgree...eensActivia.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.songtouch.com/Install.exe
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphoto...ploadClient.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.mac...ash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 13214 bytes

-- Files created between 2008-05-28 and 2008-06-28 -----------------------------

2008-06-27 15:08:05 0 d-------- C:\Documents and Settings\Owner\Application Data\DNA
2008-06-27 15:04:02 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-06-27 12:56:10 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-06-27 12:56:10 0 dr-h----- C:\Documents and Settings\Administrator\Recent
2008-06-27 12:56:10 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-06-27 12:56:10 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-06-27 12:56:10 0 dr------- C:\Documents and Settings\Administrator\My Documents
2008-06-27 12:56:10 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-06-27 12:56:10 0 dr------- C:\Documents and Settings\Administrator\Favorites
2008-06-27 12:56:10 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-06-27 12:56:10 0 d---s---- C:\Documents and Settings\Administrator\Cookies
2008-06-27 12:56:10 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-06-27 12:56:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-06-27 12:56:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-06-27 12:56:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-06-27 12:56:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
2008-06-27 12:56:10 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-06-27 12:56:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2008-06-27 12:56:09 0 d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-06-27 12:56:09 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-06-27 12:56:09 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-06-27 12:56:09 1048576 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-06-27 12:27:58 0 d-------- C:\Program Files\ITI
2008-06-26 11:31:11 0 d-------- C:\Program Files\Panda Security
2008-06-26 11:20:34 0 d-------- C:\WINDOWS\LMIA.tmp
2008-06-26 11:19:42 0 d-------- C:\WINDOWS\LMI9.tmp
2008-06-25 23:02:18 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-25 23:02:09 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-25 23:02:09 0 d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2008-06-25 23:01:31 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-25 22:44:55 0 d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-06-25 22:44:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-25 22:44:48 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-25 22:44:12 0 d-------- C:\Program Files\Common Files\Download Manager
2008-06-25 17:53:41 0 d-------- C:\Program Files\Trend Micro
2008-06-25 00:12:09 0 d-------- C:\Program Files\Crawler
2008-06-25 00:11:56 141312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-06-25 00:11:55 0 d-------- C:\Documents and Settings\Owner\Application Data\Spyware Terminator
2008-06-25 00:11:55 0 d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-06-25 00:11:52 0 d-------- C:\Program Files\Spyware Terminator
2008-06-24 19:53:26 0 d-------- C:\WINDOWS\LMI11.tmp
2008-06-24 19:52:35 0 d-------- C:\WINDOWS\LMI10.tmp
2008-05-31 19:21:45 0 d-------- C:\Documents and Settings\Mason\Application Data\Roxio


-- Find3M Report ---------------------------------------------------------------

2008-06-28 11:42:09 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-27 15:08:55 0 d-------- C:\Program Files\DNA
2008-06-25 23:01:31 0 d-------- C:\Program Files\Common Files
2008-06-17 14:15:47 0 d-------- C:\Program Files\Azureus
2008-05-30 22:02:35 0 d-------- C:\Program Files\Symantec
2008-05-22 19:29:02 0 d-------- C:\Program Files\Free WMA to MP3 Converter
2008-05-13 22:35:44 0 d-------- C:\Program Files\Auction Sentry
2008-05-01 12:52:24 0 d-------- C:\Documents and Settings\Owner\Application Data\Photodex


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [04/14/2004 04:43 PM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/10/2007 01:59 AM]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [01/14/2007 03:11 AM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [11/28/2007 08:51 PM]
"VTTimer"="VTTimer.exe" [10/22/2004 11:53 AM C:\WINDOWS\system32\VTTimer.exe]
"USBToolTip"="C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [01/23/2006 03:42 PM]
"UpdateManager"="c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [08/19/2003 01:01 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [04/02/2004 05:11 PM]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [12/18/2003 03:31 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [01/20/2007 06:25 PM]
"PS2"="C:\WINDOWS\system32\ps2.exe" [09/12/2003 11:13 PM]
"PinnacleDriverCheck"="C:\WINDOWS\system32\\PSDrvCheck.exe" [11/10/2003 04:06 PM]
"PCLEUSBTip"="C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [01/23/2006 03:42 PM]
"Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [09/23/2003 02:01 AM]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []
"KBD"="C:\HP\KBD\KBD.EXE" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [01/16/2004 11:16 PM]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [05/07/1998 08:04 PM]
"AGRSMMSG"="AGRSMMSG.exe" [06/29/2004 10:06 AM C:\WINDOWS\AGRSMMSG.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
"Worms2.exe"="C:\DOCUME~1\Josiah\MYDOCU~1\MYVIDE~1\WORMS2~1.exe" []
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []
"RecordNow!"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 12:24 PM]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" []
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [07/17/2007 12:03 PM]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [05/08/2008 02:52 PM]
"AIM"="C:\Program Files\AIM\aim.exe" [08/05/2005 03:08 PM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/27/2007 11:39 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [10/30/2006 4:42:25 PM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 02/27/2007 11:39 AM 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

*Newly Created Service* - COMHOST
  • 0

#18
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

  • 0

#19
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
I am on netscape. When I click on the "accept" button of Kaspersky it does nothing. I tried IE and it won't even load the page, stays busy. On firefox, it does the same as netscape, not letting me continue.
  • 0

#20
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Do this then

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
  • 0

#21
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
Okay Rorschach. I was able to get IE to start working and I was able to download and run Kaspersky. Thank you for sending the option. I hadn't been able to get on to let you know I was able to download because G2G sometimes shows that my password doesn't match. Don't know what's up with that but it's all working out.

Here it is. Thanks so much for the help :)







<html>
<head>
<title>KASPERSKY ONLINE SCANNER REPORT</title>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'>
</head>

<style>
.pagetitle { font-size:20px; color:#FFFFFF; font-family: Arial, Geneva, sans-serif; }
.text { font-size:11px; font-family: Arial, Geneva, sans-serif; }
TD { font-size:11px; font-family: Arial, Geneva, sans-serif; }
</style>

<body>
<table width='100%' height='110' border='0'>
<tr height='30' align='center' bgcolor='#005447'>
<td colspan='2' height='30' class='pagetitle'>
<b>KASPERSKY ONLINE SCANNER REPORT</b>
</td>
</tr>
<tr height='70'>
<td colspan='2' height='70'>
Saturday, June 28, 2008 9:15:06 PM<br>
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)<br>
Kaspersky Online Scanner version: 5.0.98.0<br>
Kaspersky Anti-Virus database last update: 28/06/2008<br>
Kaspersky Anti-Virus database records: 895978<br>
</td>
</tr>
<tr height='10'>
<td colspan='2' height='10'>
</td>
</tr>
</table>
<table width='100%' height='145' border='0'>
<tr height='20' bgcolor='#EFEBDE'>
<td colspan='2' height='20'><b>Scan Settings</b></td>
</tr>
<tr height='15'>
<td height='15' width='250'>Scan using the following antivirus database</td>
<td>extended</td>
</tr>
<tr height='15'>
<td height='15'>Scan Archives</td>
<td>true</td>
</tr>
<tr height='15'>
<td height='15'>Scan Mail Bases</td>
<td>true</td>
</tr>
<tr height='10'>
<td colspan='2' height='10'>
</td>
</tr>
<tr height='20' bgcolor='#EFEBDE'>
<td height='20'><b>Scan Target</b></td>
<td>My Computer</td>
</tr>
<tr height='20'>
<td colspan='2' height='20'>
C:\<br>
D:\<br>
E:\<br>
F:\<br>
G:\<br>
H:\<br>
I:\<br>
J:\<br>
K:\
</td>
</tr>
<tr height='10'>
<td colspan='2' height='10'>
</td>
</tr>
<tr height='20' bgcolor='#EFEBDE'>
<td colspan='2' height='20'><b>Scan Statistics</b></td>
</tr>
<tr height='15'>
<td height='15'>Total number of scanned objects</td>
<td>250102</td>
</tr>
<tr height='15'>
<td height='15'>Number of viruses found</td>
<td>24</td>
</tr>
<tr height='15'>
<td height='15'>Number of infected objects</td>
<td>87</td>
</tr>
<tr height='15'>
<td height='15'>Number of suspicious objects</td>
<td>0</td>
</tr>
<tr height='15'>
<td height='15'>Duration of the scan process</td>
<td>03:29:26</td>
</tr>
</table>
<br>
<table width='100%' border='0'>
<tr height='20' bgcolor='#EFEBDE'>
<td height='20'><b>Infected Object Name</b></td>
<td width='200'><b>Virus Name</b></td>
<td width='100'><b>Last Action</b></td>
</tr>
<tr height='20'>
<td height='20'>C:\1 g bu\Josiah\dbzblurscreen.exe/WISE0014.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.Quick.a </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\1 g bu\Josiah\dbzblurscreen.exe/WISE0015.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.NewDotNet </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\1 g bu\Josiah\dbzblurscreen.exe/WISE0016.BIN </td>
<td>Infected: Trojan-Dropper.Win32.Small.jh </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\1 g bu\Josiah\dbzblurscreen.exe </td>
<td>WiseSFX: infected - 3 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\biyxjcyi.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\fhcsrbxq.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\gflonmxe.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\gppkerms.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\ifgxvhlk.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\iyohuycj.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\khnvxdvo.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\lfloajsn.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\moewbpwl.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\nynyqsqf.exe </td>
<td>Infected: Trojan-Downloader.Win32.Agent.gwe </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\ogqyahon.exe </td>
<td>Infected: Trojan-Downloader.Win32.Agent.gwe </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\qqlujmxh.exe </td>
<td>Infected: Trojan.Win32.Obfuscated.kp </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\qvolubao.exe </td>
<td>Infected: Trojan-Downloader.Win32.Agent.gwe </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\vvnkgwcc.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\vxrdjehn.exe </td>
<td>Infected: Trojan.Win32.Monder.gen </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Deckard\System Scanner\20080627212538\backup\DOCUME~1\Owner\LOCALS~1\Temp\wagslkdy.exe </td>
<td>Infected: Trojan-Downloader.Win32.Agent.gwe </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0d96-27c0317d.zip/vlocal.class </td>
<td>Infected: Trojan-Downloader.Java.Agent.f </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0d96-27c0317d.zip </td>
<td>ZIP: infected - 1 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\Local Settings\Temp\hyncvwvw.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\Local Settings\Temp\jivpejed.exe </td>
<td>Infected: Trojan-Downloader.Win32.Tiny.id </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\153445.exe/WISE0013.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.NewDotNet </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\153445.exe/WISE0014.BIN </td>
<td>Infected: not-a-virus:AdTool.Win32.WhenU.a </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\153445.exe </td>
<td>WiseSFX: infected - 2 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\153445.exe </td>
<td>WiseSFXDropper: infected - 2 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\issuezcursors.exe/WISE0014.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.NewDotNet </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\issuezcursors.exe/WISE0015.BIN </td>
<td>Infected: not-a-virus:AdTool.Win32.WhenU.a </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\issuezcursors.exe/WISE0016.BIN </td>
<td>Infected: not-a-virus:AdTool.Win32.WhenU.a </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\issuezcursors.exe </td>
<td>WiseSFX: infected - 3 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Alex\My Documents\school\JR YEAR\issuezcursors.exe </td>
<td>WiseSFXDropper: infected - 3 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-06-28_Log.ALUSchedulerSvc.LiveUpdate </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0913639E.exe/stream/data0008 </td>
<td>Infected: not-a-virus:AdWare.Win32.Comet.ay </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0913639E.exe/stream/data0026 </td>
<td>Infected: not-a-virus:AdWare.Win32.Comet.ay </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0913639E.exe/stream </td>
<td>Infected: not-a-virus:AdWare.Win32.Comet.ay </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0913639E.exe </td>
<td>NSIS: infected - 3 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0913639E.exe </td>
<td>CryptFF: infected - 3 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\18E91463 </td>
<td>Infected: Backdoor.Win32.IRCBot.jv </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\18E91463.pif </td>
<td>Infected: Backdoor.Win32.IRCBot.jv </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\332E175E.ase </td>
<td>Infected: not-a-virus:AdWare.Win32.ClearSearch.j </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35BA1E7E.exe </td>
<td>Infected: not-a-virus:AdWare.Win32.NewDotNet </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52A00A13.cab/twaintec.dll </td>
<td>Infected: not-a-virus:AdWare.Win32.BiSpy.f </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52A00A13.cab/preInsTT.exe </td>
<td>Infected: not-a-virus:AdWare.Win32.BiSpy.f </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52A00A13.cab/polall1m.exe/polall1m.exe </td>
<td>Infected: Trojan-Downloader.Win32.Agent.ae </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52A00A13.cab/polall1m.exe </td>
<td>Infected: Trojan-Downloader.Win32.Agent.ae </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52A00A13.cab </td>
<td>CAB: infected - 4 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52A00A13.cab </td>
<td>CryptFF: infected - 4 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7F386121.exe </td>
<td>Infected: not-a-virus:AdWare.Win32.Quick.b </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\2EC39B8B.TMP </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\5E7ED735.TMP </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0019.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.Quick.a </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0020.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.NewDotNet </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0021.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.EZula.u </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0022.BIN/data0003/data0001 </td>
<td>Infected: not-a-virus:AdWare.Win32.WebRebates.g </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0022.BIN/data0003 </td>
<td>Infected: not-a-virus:AdWare.Win32.WebRebates.g </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0022.BIN/data0004 </td>
<td>Infected: not-a-virus:AdWare.Win32.WebRebates.b </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0022.BIN/data0005 </td>
<td>Infected: not-a-virus:AdWare.Win32.HelpExpress </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0022.BIN/data0006 </td>
<td>Infected: not-a-virus:AdWare.Win32.WebRebates.b </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe/WISE0022.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.WebRebates.b </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\All Users\Documents\24273.exe </td>
<td>WiseSFX: infected - 9 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Josiah\Local Settings\Temp\lavfwgnv.exe </td>
<td>Infected: Trojan-Downloader.Win32.Agent.gwe </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Josiah\My Documents\Azureus Downloads\HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc).rar/HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc)/chinese/HC.EXE/HyCam2.exe </td>
<td>Infected: Backdoor.Win32.Rbot.qww </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Josiah\My Documents\Azureus Downloads\HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc).rar/HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc)/chinese/HC.EXE </td>
<td>Infected: Backdoor.Win32.Rbot.qww </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Josiah\My Documents\Azureus Downloads\HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc).rar/HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc)/japanese/HC.EXE/HyCam2.exe </td>
<td>Infected: Backdoor.Win32.Rbot.qww </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Josiah\My Documents\Azureus Downloads\HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc).rar/HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc)/japanese/HC.EXE </td>
<td>Infected: Backdoor.Win32.Rbot.qww </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Josiah\My Documents\Azureus Downloads\HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc).rar </td>
<td>RAR: infected - 4 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\LocalService\Cookies\index.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\LocalService\NTUSER.DAT </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\LocalService\ntuser.dat.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Mason\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0d96-64a5a360.zip/vlocal.class </td>
<td>Infected: Trojan-Downloader.Java.Agent.f </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Mason\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0d96-64a5a360.zip </td>
<td>ZIP: infected - 1 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\NetworkService\NTUSER.DAT </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\NetworkService\ntuser.dat.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\Cookies\index.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\NTUSER.DAT </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Documents and Settings\Owner\ntuser.dat.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Aluria Software\ASE\Backup\99601187.ase/data0001 </td>
<td>Infected: not-a-virus:AdWare.Win32.BargainBuddy.r </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Aluria Software\ASE\Backup\99601187.ase </td>
<td>NSIS: infected - 1 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\AWS\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE/WISE0016.BIN </td>
<td>Infected: not-a-virus:AdWare.Win32.MyWay.j </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\AWS\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE </td>
<td>WiseSFX: infected - 1 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\AWS\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE </td>
<td>WiseSFXDropper: infected - 1 </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Real\Toolbar\RealBar.dll </td>
<td>Infected: not-a-virus:AdWare.Win32.MegaSearch.s </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\SNDALRT.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\SNDCON.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\SNDDBG.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\SNDFW.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\SNDIDS.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Common Files\Symantec Shared\SNDSYS.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chandir.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chandir.idx </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chn.dat </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\chn.idx </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\D0000000.FCS </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\inuse.txt </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\L0000003.FCS </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr height='20'>
<td height='20'>C:\Program Files\Compaq Connections\1940576\Users\Default\Data\main.log </td>
<td>Object is locked </td>
<td>skipped </td>
</tr>
<tr><td c
  • 0

#22
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
    C:\1 g bu\Josiah\dbzblurscreen.exe
    C:\Documents and Settings\Alex\My Documents\school\JR YEAR\153445.exe
    C:\Documents and Settings\Alex\My Documents\school\JR YEAR\issuezcursors.exe
    C:\Documents and Settings\All Users\Documents\24273.exe
    C:\Documents and Settings\Josiah\My Documents\Azureus Downloads\HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc).rar
    C:\Program Files\Aluria Software\ASE\Backup\99601187.ase
    C:\Program Files\AWS\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE
    C:\Program Files\Common Files\Real\Toolbar\RealBar.dll
    purity 
    EmptyTemp
    [start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Open Notepad and Copy (Control+C) and Paste (Control+V) the following code into the Notepad window.


@echo off
dir "C:\Documents and Settings\Josiah\My Documents\Azureus Downloads">C:\peek.txt
start C:\peek.txt
del peek.bat


Click on 'File' then 'Save As'
In the Save in drop down box select Desktop
In the File name box type in peek.bat
In the Save as type drop down box select All Files
Close Notepad.

Now, find peek.bat on your Desktop and Double click it
A window will open and close, do not be concerned this is normal.


Post the resulting notepad file that appears
  • 0

#23
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
Here is the log from OTMoveit2. When it came to this part

Open Notepad and Copy (Control+C) and Paste (Control+V) the following code into the Notepad window.


CODE
@echo off
dir "C:\Documents and Settings\Josiah\My Documents\Azureus Downloads">C:\peek.txt
start C:\peek.txt
del peek.bat



Click on 'File' then 'Save As'
In the Save in drop down box select Desktop
In the File name box type in peek.bat
In the Save as type drop down box select All Files
Close Notepad.

Now, find peek.bat on your Desktop and Double click it
A window will open and close, do not be concerned this is normal.


Post the resulting notepad file that appears


This is where I am lost. Where do I get notepad from? Will it be a clean notepad that I attach these items to? Just a little more hand holding. Thanks :)



Explorer killed successfully
C:\1 g bu\Josiah\dbzblurscreen.exe moved successfully.
C:\Documents and Settings\Alex\My Documents\school\JR YEAR\153445.exe moved successfully.
C:\Documents and Settings\Alex\My Documents\school\JR YEAR\issuezcursors.exe moved successfully.
C:\Documents and Settings\All Users\Documents\24273.exe moved successfully.
C:\Documents and Settings\Josiah\My Documents\Azureus Downloads\HyperCam ver. 2.14.01 all laguages plus cracks(w___olf.inc).rar moved successfully.
C:\Program Files\Aluria Software\ASE\Backup\99601187.ase moved successfully.
C:\Program Files\AWS\WeatherBug\Install\WxBugSetup60b6.04.0.9m.EXE moved successfully.
C:\Program Files\Common Files\Real\Toolbar\RealBar.dll unregistered successfully.
C:\Program Files\Common Files\Real\Toolbar\RealBar.dll moved successfully.
< purity >
< EmptyTemp >
File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\IadHide4.dll scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 06292008_133905

Files moved on Reboot...
DllUnregisterServer procedure not found in C:\DOCUME~1\Owner\LOCALS~1\Temp\IadHide4.dll
C:\DOCUME~1\Owner\LOCALS~1\Temp\IadHide4.dll NOT unregistered.
C:\DOCUME~1\Owner\LOCALS~1\Temp\IadHide4.dll moved successfully.
  • 0

#24
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
A notepad should pop up after you run the .bat file

Is this present

C:\peek.txt

Post that text file if it is
  • 0

#25
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
Is this present

C:\peek.txt


No. I don't see it at all. A box did flicker, but no notepad opened up.
  • 0

Advertisements


#26
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
Here is exactly what I did in the first place to try to folllow the directions.

I opened the log that was pasted for the OTMoveit2 report. From there I added the text you wanted me to copy at the bottom of the report(Could that be the problem? Should I have had a clean page?). Went through all the save instructions and pressed save. I closed the file and saw the box flicker once. On my desktop was "peek.bat" I double clicked it and also tried right click and then open, but nothing.

Does that help with what I need to do next?
  • 0

#27
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
It's fine

  • Make sure you have an Internet Connection.
  • Double-click OTMoveIt2.exe to run it.
  • Click on the CleanUp! button
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
  • Click Yes to beging the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here




Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
  • 0

#28
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
Okay! I've done everything down to and including installing JRE. It seems that my computer would be clean and I thank you so much for that :)

What I would like to know next is how to delete all the downloads that I have done during this process and saved to desktop. I think that is all I can think to ask. I will continue to download the other anti virus downloads and learn more about how to keep these viruses off.
  • 0

#29
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
The OTMoveIt2 step should have removed them all

Just go and delete any left over ones

Tell me how that goes
  • 0

#30
Mikey83

Mikey83

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
OTMoveit2 was already deleted like you said it would. The other programs like anitspyware,Malwarebyte etc were deleted off the desktop by right clicking.

Is all well and i'm set to go?! The computer is running faster and we haven't been getting the pop up that a program has to shut down.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP