Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Spyware/Malware/Spamming [RESOLVED]


  • This topic is locked This topic is locked

#31
Trout27

Trout27

    Member

  • Topic Starter
  • Member
  • PipPip
  • 57 posts
Here is the dss log:

Deckard's System Scanner v20071014.68
Run by default on 2008-07-29 19:33:30
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 81% (more than 75%).
Total Physical Memory: 384 MiB (512 MiB recommended).
System Drive C: has 3.74 GiB (less than 15%) free.


-- HijackThis (run as default.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:34:01 PM, on 7/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\default\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\default.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon....p;bm=ho_central
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Microsoft Works Portfolio] "C:\Program Files\Microsoft Works\WksSb.exe" /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] "C:\Program Files\Microsoft Works\WkDetect.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] "C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] "C:\Program Files\Verizon\McciTrayApp.exe"
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User 'Default user')
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com/ (file missing) (HKCU)
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfi...IOS/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://mail.teachsp...emote/msrdp.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn...ro.cab56649.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

--
End of file - 10141 bytes

-- Files created between 2008-06-29 and 2008-07-29 -----------------------------

2008-07-27 23:58:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-27 23:58:54 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-07-27 21:07:54 0 d-------- C:\Documents and Settings\default\Application Data\PCToolsFirewallPlus
2008-07-27 21:03:15 93440 --a------ C:\WINDOWS\system32\drivers\pctfw.sys <Not Verified; PC Tools; PC Tools NDIS Driver>
2008-07-27 21:03:10 0 d-------- C:\Program Files\PC Tools Firewall Plus
2008-07-27 21:01:25 0 d-------- C:\Program Files\ThreatFire
2008-07-27 20:49:29 0 d-------- C:\Documents and Settings\default\Application Data\PC Tools
2008-07-27 20:45:17 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-27 20:44:44 0 d-------- C:\Program Files\Common Files\PC Tools
2008-07-27 20:44:32 0 d-------- C:\Program Files\PC Tools AntiVirus
2008-07-27 20:44:32 0 d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-07-26 19:32:32 0 d-------- C:\cmdcons
2008-07-26 19:28:24 68096 --a------ C:\WINDOWS\zip.exe
2008-07-26 19:28:24 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-26 19:28:24 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-26 19:28:24 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-26 19:28:24 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-26 19:28:24 98816 --a------ C:\WINDOWS\sed.exe
2008-07-26 19:28:24 80412 --a------ C:\WINDOWS\grep.exe
2008-07-26 19:28:24 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-07-25 00:40:16 0 d-------- C:\Program Files\Trend Micro
2008-07-15 18:02:11 90756 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-07-14 22:54:59 0 d-------- C:\Program Files\Bonjour
2008-07-14 21:39:44 0 d-------- C:\Program Files\Safari
2008-07-03 16:04:42 0 d-------- C:\Documents and Settings\default\Application Data\Malwarebytes
2008-07-03 16:04:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-03 16:04:35 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-03 12:40:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft


-- Find3M Report ---------------------------------------------------------------

2008-07-01 13:42:24 31744 --a------ C:\Documents and Settings\default\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2008-06-05 21:56:46 128368 --a------ C:\Documents and Settings\default\Application Data\GDIPFONTCACHEV1.DAT
2008-05-10 01:36:34 2645624 --ah----- C:\Documents and Settings\default\Application Data\IconCache.db


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [08/10/2000 12:00 PM]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [08/10/2000 12:00 PM]
"NvCplDaemon"="RUNDLL32.exe" [08/04/2004 03:56 AM C:\WINDOWS\SYSTEM32\rundll32.exe]
"nwiz"="nwiz.exe" [09/27/2002 02:38 PM C:\WINDOWS\SYSTEM32\nwiz.exe]
"MULTIMEDIA KEYBOARD"="C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe" [07/12/2002 12:22 AM]
"mmtask"="C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [10/29/2003 03:57 PM]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [05/21/2004 07:11 PM]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [06/01/2004 11:09 AM]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [06/01/2004 11:03 AM]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [01/13/2006 08:13 PM]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [01/13/2006 08:13 PM]
"Verizon_McciTrayApp"="C:\Program Files\Verizon\McciTrayApp.exe" [03/11/2007 05:37 PM]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [02/01/2006 06:33 PM]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [12/22/2003 08:38 AM]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/2005 11:46 PM]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/10/2008 10:51 AM]
"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [03/05/2008 09:37 AM]
"ThreatFire"="C:\Program Files\ThreatFire\TFTray.exe" [04/24/2008 04:52 PM]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [07/02/2008 04:51 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [06/01/2004 05:46 AM]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/14/2007 07:23 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [06/05/2008 09:20 AM]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [06/10/2007 05:31 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"Printing Migration"=rundll32.exe C:\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
@=00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [05/25/2008 05:37 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 07/29/2007 10:33 AM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"UpdReg"=C:\WINDOWS\Updreg.exe
"LoadQM"=loadqm.exe
"HPDJ Taskbar Utility"=C:\WINDOWS\SYSTEM32\hpztsb03.exe
"WorksFUD"=C:\Program Files\Microsoft Works\wkfud.exe
"RxMon"=C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon9x.exe
"madexe"=C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\mad.exe
"Speed racer"=C:\Program Files\Creative\PlayCenter\CTSRReg.exe
"AudioHQ"=C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
"WhenUSave"=C:\PROGRA~1\SAVE\Save.exe
"MMTray"=C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
"Tweak UI"=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
"GhostStartTrayApp"=C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
rundll rnasetup.dll,installoptionalcomponent rna

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl



-- End of Deckard's System Scanner: finished at 2008-07-29 19:35:41 ------------
  • 0

Advertisements


#32
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Log looks very good.. Tell me why you can't connect to the internet? Do you have any connection problem?
  • 0

#33
Trout27

Trout27

    Member

  • Topic Starter
  • Member
  • PipPip
  • 57 posts
No....I am connected via the same network (wireless router). After the Avenver rebooted, I could no longer connect with that PC. I have tried rebooting again but it won't connect......
  • 0

#34
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Please download WinsockXPFix from HERE.
  • Double-click on WinsockXPFix and click on Fix
It will ask you to restart your computer in attempt to fix the internet connection. Please do so..


Then tell me, can you re-connect to the internet?
  • 0

#35
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Hi there.. I have to go to class now and will be back about after 4hrs or so..

Thank you :)
  • 0

#36
Trout27

Trout27

    Member

  • Topic Starter
  • Member
  • PipPip
  • 57 posts
OK....that fixed the internet issue...I am back on the PC...How are we doing??
  • 0

#37
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts

OK....that fixed the internet issue...I am back on the PC...How are we doing??


Good to hear.. Your log looks good.. but let see another fresh Kaspersky Webscanner result :) Just to make sure that you are clean.. :)


Post the Kaspersky Webscanner log here..


Regards
fenzodahl512

Edited by fenzodahl512, 29 July 2008 - 09:24 PM.

  • 0

#38
Trout27

Trout27

    Member

  • Topic Starter
  • Member
  • PipPip
  • 57 posts
Sounds good.....Here is the Kaspersky Scan:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, July 30, 2008 7:38:02 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 30/07/2008
Kaspersky Anti-Virus database records: 1026230
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 84870
Number of viruses found: 10
Number of infected objects: 82
Number of suspicious objects: 0
Duration of the scan process: 02:21:42

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\Program Files\PC Tools Firewall Plus\FWService.txt Object is locked skipped
C:\Program Files\PC Tools Firewall Plus\FWAuth.txt Object is locked skipped
C:\Program Files\PC Tools Firewall Plus\FirewallWrapper.txt Object is locked skipped
C:\Program Files\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.me Object is locked skipped
C:\Program Files\Kodak\Kodak EasyShare software\bin\Catalog\EasyShare.mm Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\Program Files\PC Tools AntiVirus\PCTAVService.txt Object is locked skipped
C:\Program Files\PC Tools AntiVirus\~ulo Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\PC Tools\PC Tools AntiVirus\Report Logs\Report39658.864386574074.xml Object is locked skipped
C:\Documents and Settings\All Users\Application Data\PC Tools\ThreatFire\Orig.db Object is locked skipped
C:\Documents and Settings\default\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\default\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\default\Local Settings\History\History.IE5\MSHist012008073020080731\index.dat Object is locked skipped
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\default\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\default\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\default\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\default\Application Data\Verizon\VSP\client_gateway.log Object is locked skipped
C:\Documents and Settings\default\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-7-29-2008( 20-45-22 ).LOG Object is locked skipped
C:\Documents and Settings\default\Application Data\PC Tools\PC Tools AntiVirus\Application Logs\PCToolsAntivirus.txt Object is locked skipped
C:\Documents and Settings\default\Application Data\PCToolsFirewallPlus\FirewallGUI.txt Object is locked skipped
C:\Documents and Settings\default\Application Data\PCToolsFirewallPlus\FWPlugin.txt Object is locked skipped
C:\Documents and Settings\default\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1787\A0215506.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1790\A0215564.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1790\A0215605.exe Infected: Trojan.Win32.Mondera.gen skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1790\A0215606.exe Infected: Trojan.Win32.Mondera.gen skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1790\A0215654.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1792\A0215742.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1795\A0216006.exe Infected: Trojan.Win32.Mondera.gen skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1795\A0216007.exe Infected: Trojan.Win32.Mondera.gen skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1795\A0216009.exe Infected: Trojan.Win32.Mondera.gen skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1795\A0216019.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1795\A0216026.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0216124.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218122.exe Infected: Trojan-Spy.Win32.Zbot.nm skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218123.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218124.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218125.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218126.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218127.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218128.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218129.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218130.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218131.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218132.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218133.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218134.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218135.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218136.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218137.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218138.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218139.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218140.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218141.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218142.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218143.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218144.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218145.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218146.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218147.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218148.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218149.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218150.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218151.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218152.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218153.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218154.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218155.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218156.exe Infected: Trojan.Win32.Obfuscated.gy skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1796\A0218157.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1797\A0218256.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1797\A0218258.exe Infected: Backdoor.Win32.IRCBot.crx skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1797\A0218267.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\A0218335.exe Infected: not-a-virus:RiskTool.Win32.Dtreq.a skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\A0218342.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.gen skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\A0218345.exe Infected: Backdoor.Win32.HacDef.di skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\A0218352.exe Infected: Backdoor.Win32.Iroffer.ej skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\A0218363.dll Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.20 skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\A0218372.SYS Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\A0218463.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1798\change.log Object is locked skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1788\A0215512.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1777\A0214806.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1779\A0214828.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1780\A0214861.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1781\A0214877.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1781\A0215323.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1781\A0215334.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1782\A0215349.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1783\A0215368.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1783\A0215389.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1784\A0215402.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1784\A0215408.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1789\A0215536.sys Infected: Rootkit.Win32.Agent.att skipped
C:\System Volume Information\_restore{F6F674A9-BDE7-4192-B000-F862020ECEEB}\RP1794\A0215939.sys Infected: Rootkit.Win32.Agent.att skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\ndisio.sys.vir Infected: Rootkit.Win32.Agent.att skipped
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\AdmDll.dll.vir Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.20 skipped
C:\QooBox\Quarantine\C\WINDOWS\setup86x\dtreg.exe.vir Infected: not-a-virus:RiskTool.Win32.Dtreq.a skipped
C:\QooBox\Quarantine\C\WINDOWS\setup86x\logonmgr.exe.vir Infected: not-a-virus:Server-FTP.Win32.Serv-U.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\setup86x\NetSec.exe.vir Infected: Backdoor.Win32.HacDef.di skipped
C:\QooBox\Quarantine\C\WINDOWS\setup86x\wmiserv.exe.vir Infected: Backdoor.Win32.Iroffer.ej skipped
C:\QooBox\Quarantine\C\Documents and Settings\default\ishvud.exe.vir Infected: Trojan.Win32.Mondera.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\default\mgsy.exe.vir Infected: Trojan.Win32.Mondera.gen skipped
C:\QooBox\Quarantine\C\Documents and Settings\default\uts.exe.vir Infected: Trojan.Win32.Mondera.gen skipped
C:\QooBox\Quarantine\C\!KillBox\logon.exe.vir Infected: Backdoor.Win32.IRCBot.crx skipped

Scan process completed.
  • 0

#39
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Good news, your log looks clean to my eyes....


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
    Please note that the space between x and / is needed

    Posted Image


Lastly, to keep your operating system up to date please visit the link below monthly

Please read these excellent articles by miekiemoes :
Help! My computer is slow!
How to prevent Malware

And another excellent article by CastleCops Malware Prevention: Prevent Re-infection

Please reply to this thread once more and tell us about the computer behaviour before we can close this thread :)



Have a safe and happy computing day!


Regards
fenzodahl512
  • 0

#40
Trout27

Trout27

    Member

  • Topic Starter
  • Member
  • PipPip
  • 57 posts
The computer has been running MUCH better. There have been no spam, pop-ups or strange things happening. I am running the PC tools anti virus and firewall (although I am still having some diffuiculy configuring the firewall to let me surf easily. Other than that I think it is in great shape. I am OK to do on-line bank stuff?? Am I virus free?? That said, I really appreciate all the help, you have been awesome!! THANK YOU!!!
  • 0

Advertisements


#41
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Yup.. I believe you are good to do online stuff.. Do remember to configure your Firewall and do scans with your antivirus and antispyware accordingly (every weeks or so..).. I'm closing this topic now :)
  • 0

#42
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP