Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

PSGaurd [RESOLVED]


  • This topic is locked This topic is locked

#16
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Your log looks OK

Lets check one more time

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

  • 0

Advertisements


#17
Z0diak

Z0diak

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Saturday, September 10, 2005 18:37:56
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 10/09/2005
Kaspersky Anti-Virus database records: 148702
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 57721
Number of viruses found: 12
Number of infected objects: 112
Number of suspicious objects: 0
Duration of the scan process: 1659 sec

Infected Object Name - Virus Name
C:\Programme\Softwin\BitDefender Free Edition\Infected\intell32.exe Infected: Trojan.Win32.Small.ev
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP12\A0003839.exe Infected: Trojan-Dropper.Win32.Small.wi
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP12\A0003840.hta Infected: Trojan-Dropper.VBS.Small.d
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0007365.exe Infected: Trojan-Dropper.Win32.Agent.jz
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016229.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016250.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016266.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016274.dll Infected: Trojan-Downloader.Win32.Agent.pe
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016286.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016298.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016317.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016336.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016357.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0016374.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0017374.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0017388.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0018389.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0018402.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019402.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019419.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019438.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019455.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019472.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019491.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019511.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019525.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019543.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019566.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019584.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019601.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019620.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019632.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019647.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019662.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019677.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019691.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019702.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019716.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019731.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019749.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0019765.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020779.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020797.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020813.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020830.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020846.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020861.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020884.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020900.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020920.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020936.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0020960.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0021961.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0021985.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0021995.dll Infected: Trojan-Downloader.Win32.Agent.bc
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0022018.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0022028.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0022047.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0022049.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0022050.dll Infected: Trojan-Downloader.Win32.Agent.bc
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0023046.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0023060.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0023075.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0023093.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0023095.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0024092.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0024137.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0024166.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0024249.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0024309.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0024484.dll Infected: Trojan-Downloader.Win32.Agent.bc
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP13\A0024485.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0024516.ini:njvonn:$DATA Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0024517.exe Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0024518.exe Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0024519.dll Infected: Trojan-Downloader.Win32.ConHook.d
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0024520.exe Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0024523.dll Infected: Trojan-Downloader.Win32.Agent.bc
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0024532.dll Infected: Trojan-Downloader.Win32.Agent.bc
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025668.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025669.dll Infected: Trojan-Downloader.Win32.Agent.bc
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025670.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025671.dll Infected: Trojan-Downloader.Win32.Agent.pe
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025672.dll/data0001.html Infected: not-a-virus:AdWare.SearchPage
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025672.dll/data0002.html Infected: not-a-virus:AdWare.SearchPage
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025672.dll/data0003.html Infected: not-a-virus:AdWare.SearchPage
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025672.dll/data0004.html Infected: not-a-virus:AdWare.SearchPage
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025672.dll/data0005.html Infected: not-a-virus:AdWare.SearchPage
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025672.dll Infected: not-a-virus:AdWare.SearchPage
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025673.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025674.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025675.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025677.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025678.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025679.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025680.dll Infected: Trojan-Downloader.Win32.Agent.pe
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025681.dll Infected: Trojan-Downloader.Win32.Agent.pe
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025682.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025683.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025684.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025685.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025686.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025687.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025688.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025689.exe Infected: Trojan-Downloader.Win32.Agent.bq
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025690.exe Infected: Trojan.Win32.Agent.em
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0025711.exe Infected: Trojan.Win32.Small.ev
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0028908.dll Infected: Virus.Win32.Nsag.b
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0028927.dll Infected: Trojan.Win32.Small.ev
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0028928.exe Infected: Trojan.Win32.Small.ev
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0028931.dll Infected: Trojan-Downloader.Win32.Agent.bc
C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP14\A0028957.dll Infected: Trojan.Win32.Agent.cs

Scan process completed.


Um.... I guess that didn't go the way we wanted.
  • 0

#18
Z0diak

Z0diak

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Um loophole I'm going to be gone till tomorrow so you can help other people . I won't be back for the next 14 hours or so, so you don't need to worry about me at the moment. But thanks a lot for your help so far :tazz: .

cya tomorrow :)
  • 0

#19
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
actually none of those are a problem

do this to get rid of those entries

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
  • 0

#20
Z0diak

Z0diak

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Ok I did what you told me and then did a Kaspersky scan :

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, September 11, 2005 10:31:06
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 11/09/2005
Kaspersky Anti-Virus database records: 148810
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 50899
Number of viruses found: 1
Number of infected objects: 1
Number of suspicious objects: 0
Duration of the scan process: 1560 sec

Infected Object Name - Virus Name
C:\Programme\Softwin\BitDefender Free Edition\Infected\intell32.exe Infected: Trojan.Win32.Small.ev

Scan process completed.

Anything else I should post?
  • 0

#21
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Open HiJackThis. It should open to a "New users quickstart" menu
Click "Open the Misc Tools section"
Click "Delete a file on reboot..."
In the "Enter file to delete on reboot..." window, navigate to:

C:\Programme\Softwin\BitDefender Free Edition\Infected

And select the file

intell32.exe

Then click Open. After you click Open, HiJackThis will ask you if you want to restart your computer now. You do, so click Yes.

Post one last Hijack log please
  • 0

#22
Z0diak

Z0diak

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Logfile of HijackThis v1.99.1
Scan saved at 20:46:28, on 11.09.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Dokumente und Einstellungen\Zacha\Desktop\Geek to go stuff\security suite\ewidoctrl.exe
C:\Dokumente und Einstellungen\Zacha\Desktop\Geek to go stuff\security suite\ewidoguard.exe
C:\Programme\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programme\Intel\Intel Application Accelerator\iaanotif.exe
C:\Programme\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programme\CyberLink\PowerDVD\DVDLauncher.exe
C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\T-Com\Sinus 154 data II\TS154USB.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Zacha\Desktop\Geek to go stuff\HJackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Programme\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Programme\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [DVDLauncher] "C:\Programme\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Programme\Softwin\BitDefender Free Edition\bdnagent.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:GER
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: T-Com WLAN Manager.lnk = C:\Programme\T-Com\Sinus 154 data II\TS154USB.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Programme\AIM95\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...84/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq....yssey_web11.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,21/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{75BABFA8-50CF-4F22-82F6-F6C57AB64301}: NameServer = 194.25.2.129,192.168.2.1
O18 - Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Programme\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CWShredder Service - Unknown owner - C:\Dokumente und Einstellungen\Zacha\Desktop\cwshredder.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Dokumente und Einstellungen\Zacha\Desktop\Geek to go stuff\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Dokumente und Einstellungen\Zacha\Desktop\Geek to go stuff\security suite\ewidoguard.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Programme\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

her's the log (again^^)
  • 0

#23
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
your system is clean :tazz:

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

Detect and Remove Programs:
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
Prevention Programs:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
Other necessary Programs:
  • AntiVirus Program<= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kapersky, this is a must have.
  • Firewall<= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
  • More Secure Browser<= Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox, however Opera and SlimBrowsers are good as well.
And also see TonyKlein's good advice
So how did I get infected in the first place? and Spyware Aid's spyware article: Spyware, Adware, Malware: What it is, how it got on my computer, how to get rid of it, and how to prevent it.
  • 0

#24
Z0diak

Z0diak

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Thanks for the tipps (and the all the help altogether) but befor you go I have two questions

1. Do you now any good programms to repair malfunctioning files?

2. Um.. I can't pay for any programms (cuz i'm poor^^) and edwido is a 14 day trial so should i get ride of it?
  • 0

#25
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Sure :)

1. No I'm sorry I dont

2. yes you can uninstall it

Good luck to you :tazz:
  • 0

Advertisements


#26
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP