1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Please Review Log

Discussion in 'Malware and Virus Removal Archive' started by deester, 2009/01/30.

  1. 2009/01/30
    deester

    deester Inactive Alumni Thread Starter

    Joined:
    2008/07/08
    Messages:
    633
    Likes Received:
    0
    [Inactive] Please Review Log

    I ran a Kaspersky report and found a virus. Will someone review this log and let me know the status of my computer. Thanks a lot

    DDS (Ver_09-01-19.01) - NTFSx86
    Run by dee at 19:52:57.34 on Fri 01/30/2009
    Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.510 [GMT -5:00]

    AV: McAfee VirusScan *On-access scanning enabled* (Updated)
    FW: McAfee Personal Firewall *enabled*

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\brsvc01a.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\brss01a.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\LogMeIn\x86\RaMaint.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Program Files\LogMeIn\x86\LMIGuardian.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Norton Ghost\Agent\VProSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\PSIService.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\WINDOWS\system32\StacSV.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\WLTRAY.exe
    C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Common Files\AOL\1213497838\ee\AOLSoftware.exe
    C:\Program Files\Norton Ghost\Agent\VProTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
    C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\LogMeIn\x86\LMIGuardian.exe
    C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\AOL 9.1\waol.exe
    C:\Program Files\AOL 9.1\shellmon.exe
    C:\Documents and Settings\dee\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    mDefault_Search_URL = hxxp://www.google.com/ie
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    mSearchAssistant = hxxp://www.google.com/ie
    uURLSearchHooks: RadarSync Toolbar: {399d96ca-6f9a-4fff-95fe-284e45ebb935} - c:\program files\radarsync\tbRada.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RadarSync Toolbar: {399d96ca-6f9a-4fff-95fe-284e45ebb935} - c:\program files\radarsync\tbRada.dll
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
    BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
    BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
    TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
    TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
    TB: RadarSync Toolbar: {399d96ca-6f9a-4fff-95fe-284e45ebb935} - c:\program files\radarsync\tbRada.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
    uRun: [MalwareRemovalBot] c:\program files\malwareremovalbot\MalwareRemovalBot.exe -boot
    uRun: [<NO NAME>]
    uRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
    uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe "
    uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b
    mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
    mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [HostManager] c:\program files\common files\aol\1213497838\ee\AOLSoftware.exe
    mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
    mRun: [Norton Ghost 14.0] "c:\program files\norton ghost\agent\VProTray.exe "
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe "
    mRun: [Lexmark X6100 Series] "c:\program files\lexmark x6100 series\lxbfbmgr.exe "
    mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html
    IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
    IE: Open with WordPerfect - c:\program files\wordperfect office x3\programs\WPLauncher.hta
    IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
    IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
    IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
    IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
    IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
    IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,77,65,62,5c,72,65,6c-,61,74,65,64,2e,68,74,6d,00
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
    Notify: LMIinit - LMIinit.dll
    SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\dee\applic~1\mozilla\firefox\profiles\1fpt3l0j.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox
    FF - plugin: c:\documents and settings\dee\application data\mozilla\firefox\profiles\1fpt3l0j.default\extensions\npmozax@real.com\plugins\npmozax.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npracplug.dll
    FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true
    ============= SERVICES / DRIVERS ===============

    R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2008-6-14 3456]
    R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-6-15 201320]
    R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-6-15 695624]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-6-15 79304]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-6-15 35240]
    R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-6-15 40488]
    R3 SymSnapService;SymSnapService;c:\program files\norton ghost\shared\drivers\SymSnapService.exe [2007-12-20 1553896]
    R4 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]
    R4 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-1-23 47640]
    R4 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-6-15 359248]
    R4 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-6-15 144704]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-6-15 33832]
    S4 LMIRfsClientNP;LMIRfsClientNP; [x]

    ============== File Associations ===============

    regfile=regedit.exe "%1" %*
    scrfile= "%1" %*

    =============== Created Last 30 ================

    2009-01-30 13:34 69,723 a------- c:\windows\system32\SynTPFcs.dll
    2009-01-30 13:34 191,872 a------- c:\windows\system32\drivers\SynTP.sys
    2009-01-30 13:34 114,688 a------- c:\windows\system32\SynCtrl.dll
    2009-01-30 13:34 94,299 a------- c:\windows\system32\SynTPAPI.dll
    2009-01-30 13:34 82,014 a------- c:\windows\system32\SynCOM.dll
    2009-01-30 13:34 81,920 a------- c:\windows\system32\SynTPCo2.dll
    2009-01-30 13:34 <DIR> --d----- c:\program files\Synaptics
    2009-01-29 12:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NeoEdge Networks
    2009-01-29 11:19 <DIR> --d----- c:\program files\iWin.com
    2009-01-29 11:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\iWin Games
    2009-01-28 18:49 <DIR> --d----- c:\program files\ABBYY FineReader 6.0
    2009-01-28 18:49 <DIR> --d----- c:\program files\ABBYY FineReader 5.0 Sprint
    2009-01-28 18:46 <DIR> --d----- c:\program files\Lexmark X6100 Series
    2009-01-28 18:46 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
    2009-01-28 18:46 15,104 a------- c:\windows\system32\drivers\usbscan.sys
    2009-01-28 18:46 87,040 ac------ c:\windows\system32\dllcache\wiafbdrv.dll
    2009-01-28 18:46 87,040 a------- c:\windows\system32\wiafbdrv.dll
    2009-01-28 18:31 901 a------- c:\windows\LEXSTAT.INI
    2009-01-28 18:27 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
    2009-01-28 18:27 25,856 a------- c:\windows\system32\drivers\usbprint.sys
    2009-01-28 11:54 <DIR> --d----- c:\documents and settings\dee\WINDOWS
    2009-01-27 11:47 <DIR> --d----- c:\docume~1\dee\applic~1\Elladive3
    2009-01-27 08:00 <DIR> --d----- c:\program files\Unicorn Castle
    2009-01-27 01:41 <DIR> --d----- c:\docume~1\dee\applic~1\Island
    2009-01-27 01:40 <DIR> --d----- c:\program files\Rescue at Rajini Island
    2009-01-26 13:27 208,744 a------- c:\windows\system32\muweb.dll
    2009-01-26 13:27 268,648 a------- c:\windows\system32\mucltui.dll
    2009-01-26 13:27 27,496 a------- c:\windows\system32\mucltui.dll.mui
    2009-01-26 13:25 <DIR> --d----- c:\program files\Conduit
    2009-01-26 13:25 <DIR> --d----- c:\program files\RadarSync
    2009-01-26 12:32 427,864 a------- c:\windows\system32\XceedZip.dll
    2009-01-26 12:32 1,686,016 a------- c:\windows\system32\clinetsuitex6.ocx
    2009-01-26 12:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters
    2009-01-26 12:19 <DIR> --d----- c:\program files\PC Drivers HeadQuarters
    2009-01-26 12:11 <DIR> --d----- c:\docume~1\dee\applic~1\DriverCure
    2009-01-26 12:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Downloaded Installations
    2009-01-25 18:58 1,499,136 -c------ c:\windows\system32\dllcache\shdocvw.dll
    2009-01-25 16:34 230 a------- c:\windows\system32\spupdsvc.inf
    2009-01-25 11:56 61,224 a------- c:\documents and settings\dee\GoToAssistDownloadHelper.exe
    2009-01-25 07:02 <DIR> --d----- c:\docume~1\dee\applic~1\RobinsonCrusoe
    2009-01-25 01:03 <DIR> --d----- c:\program files\The Legend of Tirnanog
    2009-01-24 20:05 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ScreenSeven
    2009-01-24 20:05 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intenium
    2009-01-24 20:00 <DIR> --d----- c:\docume~1\dee\applic~1\GameInvest
    2009-01-24 20:00 4,096 a------- c:\windows\d3dx.dat
    2009-01-23 19:33 <DIR> --d----- c:\docume~1\alluse~1\applic~1\LogMeIn
    2009-01-23 19:31 28,984 a------- c:\windows\system32\LMIport.dll
    2009-01-23 19:31 83,288 a------- c:\windows\system32\LMIRfsClientNP.dll
    2009-01-23 19:31 47,640 a------- c:\windows\system32\drivers\LMIRfsDriver.sys
    2009-01-23 19:31 87,352 a------- c:\windows\system32\LMIinit.dll
    2009-01-23 19:31 1,024 a------- C:\.rnd
    2009-01-23 19:31 <DIR> --d----- c:\program files\LogMeIn
    2009-01-23 04:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Nick Chase A Detective Story
    2009-01-22 22:09 <DIR> --d----- c:\docume~1\dee\applic~1\cerasus.media
    2009-01-22 19:40 <DIR> --d----- c:\documents and settings\dee\Saved Games
    2009-01-22 18:58 <DIR> --d----- c:\program files\iPod
    2009-01-22 18:58 <DIR> --d----- c:\program files\iTunes
    2009-01-22 18:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
    2009-01-22 18:57 <DIR> --d----- c:\program files\Bonjour
    2009-01-22 12:16 <DIR> --d----- c:\docume~1\dee\applic~1\SpinTop Games
    2009-01-22 06:24 2,414,360 a------- c:\windows\system32\d3dx9_31.dll
    2009-01-22 06:21 <DIR> --d-h--- c:\windows\msdownld.tmp
    2009-01-22 06:21 <DIR> --d----- c:\windows\Logs
    2009-01-22 04:41 <DIR> --d----- c:\program files\ATI Technologies
    2009-01-22 04:25 0 a------- c:\windows\system32\null
    2009-01-22 04:20 <DIR> --d----- c:\program files\Dell Support Center
    2009-01-22 04:20 <DIR> --d----- c:\program files\common files\supportsoft
    2009-01-21 21:48 0 a------- c:\windows\ativpsrm.bin
    2009-01-21 21:33 <DIR> --d----- c:\docume~1\dee\applic~1\Ancient Quest of Saqqarah__cminion
    2009-01-21 21:33 <DIR> --d----- c:\docume~1\dee\applic~1\Saqqarah
    2009-01-21 20:25 <DIR> --d----- c:\docume~1\dee\applic~1\JewelMatch2
    2009-01-21 18:51 664 a------- c:\windows\system32\d3d9caps.dat
    2009-01-21 17:39 552 a------- c:\windows\system32\d3d8caps.dat
    2009-01-21 14:13 <DIR> --d----- c:\windows\Super Collapse Puzzle Gallery 4
    2009-01-21 14:13 <DIR> --d----- c:\program files\Super Collapse Puzzle Gallery 4
    2009-01-21 13:28 <DIR> --d----- c:\docume~1\dee\applic~1\Symantec
    2009-01-21 13:18 <DIR> --d----- c:\program files\Symantec
    2009-01-21 13:16 107,368 a------- c:\windows\system32\GEARAspi.dll
    2009-01-21 13:16 15,464 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-01-21 13:16 128,104 a------- c:\windows\system32\drivers\WimFltr.sys
    2009-01-21 13:16 15,088 a------- c:\windows\system32\drivers\vproeventmonitor.sys
    2009-01-21 13:16 38,112 a------- c:\windows\system32\drivers\v2imount.sys
    2009-01-21 13:16 136,416 a------- c:\windows\system32\drivers\symsnap.sys
    2009-01-21 13:15 <DIR> --d----- c:\program files\common files\Symantec Shared
    2009-01-21 13:14 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Symantec
    2009-01-21 13:14 <DIR> --d----- c:\program files\Norton Ghost
    2009-01-21 12:57 32,592 a------- c:\windows\system32\msonpmon.dll
    2009-01-21 12:09 <DIR> --d----- c:\program files\Val Gor
    2009-01-21 12:08 <DIR> --d----- c:\docume~1\dee\applic~1\Meridian93
    2009-01-21 12:05 <DIR> --d----- c:\docume~1\dee\applic~1\Cat's Eye Games
    2009-01-21 12:03 <DIR> --d----- c:\program files\Games
    2009-01-21 11:11 <DIR> --d----- c:\program files\Diamond Drop 2
    2009-01-21 10:48 <DIR> --d----- c:\docume~1\dee\applic~1\PendulumQuest
    2009-01-21 10:37 <DIR> --d----- c:\program files\Mystery Case Files Huntsville
    2009-01-21 10:07 <DIR> --d----- c:\program files\GameTop.com
    2009-01-21 09:23 <DIR> --d----- c:\program files\Hawaiian Explorer Lost Island
    2009-01-21 09:18 <DIR> --d----- c:\program files\Tropicabana
    2009-01-21 09:02 <DIR> --d----- c:\program files\Enigma 7
    2009-01-21 08:40 <DIR> --d----- c:\program files\Hoteis Jewels
    2009-01-21 08:39 <DIR> --d----- c:\program files\ReflexiveArcade
    2009-01-21 07:30 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NeptunesAdve
    2009-01-21 07:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SpinTop Games
    2009-01-21 07:22 <DIR> --d----- c:\program files\Mystery P.I. - The Vegas Heist
    2009-01-21 07:07 <DIR> --d----- c:\docume~1\dee\applic~1\JoyBits
    2009-01-21 07:02 <DIR> --d----- c:\docume~1\dee\applic~1\Big Fish Games
    2009-01-21 06:58 <DIR> --d----- c:\docume~1\dee\applic~1\Abra Academy2
    2009-01-21 06:50 <DIR> --d----- c:\program files\Forgotten Riddles
    2009-01-21 02:48 <DIR> --d----- c:\docume~1\dee\applic~1\iWin
    2009-01-20 21:54 <DIR> --d----- c:\program files\Siber Systems
    2009-01-20 21:29 <DIR> --d----- c:\docume~1\dee\applic~1\Digital Support
    2009-01-20 21:29 <DIR> --d----- c:\program files\Digital Support
    2009-01-20 21:27 <DIR> --d----- c:\program files\VS Revo Group
    2009-01-05 16:18 90,112 a------- c:\windows\system32\QuickTimeVR.qtx
    2009-01-05 16:18 57,344 a------- c:\windows\system32\QuickTime.qts
    2009-01-03 20:43 <DIR> --d----- c:\program files\CCleaner
    2009-01-03 19:51 15,504 a------- c:\windows\system32\drivers\mbam.sys
    2009-01-03 19:51 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-01-03 19:51 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
    2009-01-03 19:49 <DIR> --d----- c:\docume~1\dee\applic~1\MalwareRemovalBot
    2009-01-01 14:16 <DIR> --d----- c:\windows\system32\NtmsData

    ==================== Find3M ====================

    2009-01-25 06:16 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
    2008-12-25 19:06 410,984 a------- c:\windows\system32\deploytk.dll
    2008-12-11 05:57 333,952 a------- c:\windows\system32\drivers\srv.sys
    2008-11-29 09:28 77,423 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
    2008-10-17 13:29 1,300,048 a------- c:\docume~1\alluse~1\applic~1\pswi_preloaded.exe
    2008-07-07 14:35 774,144 a------- c:\program files\RngInterstitial.dll
    2002-07-01 09:13 224 a--sh--- c:\docume~1\dee\applic~1\maildriver32.dat
    2008-10-17 13:31 8 ---shr-- c:\windows\system32\614AE4A6D2.sys

    ============= FINISH: 19:54:07.75 ===============
     
  2. 2009/01/31
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi Dee,

    Copy the bolded line below.

    c:\docume~1\dee\applic~1

    Click Start>Run and Paste the copied text into the Run dialog then hit Enter.
    Delete the folder MalwareRemovalBot


    What did Kaspersky identify?
     

  3. to hide this advert.

  4. 2009/02/01
    deester

    deester Inactive Alumni Thread Starter

    Joined:
    2008/07/08
    Messages:
    633
    Likes Received:
    0
    REboved the file. Don't know whether you saw my post or not, the desktop, we just finished cleaning was hijacked and I'm was my computer closely. Here;s Kaspersky's
    KASPERSKY ONLINE SCANNER 7 REPORT
    Friday, January 30, 2009
    Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Friday, January 30, 2009 20:33:51
    Records in database: 1729318
    Scan settings
    Scan using the following database extended
    Scan archives yes
    Scan mail databases yes
    Scan area My Computer
    C:\
    D:\
    Scan statistics
    Files scanned 83204
    Threat name 1
    Infected objects 1
    Suspicious objects 0
    Duration of the scan 02:37:54

    File name Threat name Threats count
    C:\Documents and Settings\dee\Desktop\WinRAR.exe Infected: Backdoor.Win32.VB.gxt 1
    The selected area was scanned.
     
  5. 2009/02/01
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Provided you downloaded that from a legit site, that file is likely OK. It should also just be the setup file and OK to delete if you've already installed WinRAR
     
  6. 2009/02/01
    deester

    deester Inactive Alumni Thread Starter

    Joined:
    2008/07/08
    Messages:
    633
    Likes Received:
    0
    I have several winrare files , I had uninstalled the Malwarebuye bot file several days ago,
    Dee
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.