1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved SVEHOST.EXE Spyware

Discussion in 'Malware and Virus Removal Archive' started by cryptmagic, 2007/11/26.

  1. 2007/11/26
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    [Resolved]SVEHOST.EXE Spyware

    Hi i have windows vista and have noticed that a program svehost.exe trys to access the interenet i believe it is spyware. My Microsoft Onecare blocks it, but i can't seem to get it of my system i ran hijck this and removed a few entries. Here is my current hijack this log.
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:47:04 PM, on 11/26/2007
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16546)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe
    C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
    C:\Windows\system32\javaw.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe "
    O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" /r
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe "
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://chat2.j2.com/Media/VisitorchatEnu/TLIEFlash.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BXGC - Unknown owner - C:\Users\CRYPTM~1\AppData\Local\Temp\BXGC.exe (file missing)
    O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    O23 - Service: DWHZLZV - Unknown owner - C:\Users\CRYPTM~1\AppData\Local\Temp\DWHZLZV.exe (file missing)
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LRPIPI - Unknown owner - C:\Users\CRYPTM~1\AppData\Local\Temp\LRPIPI.exe (file missing)
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe

    --
    End of file - 8641 bytes
     
    cryptmagic,
    #1
  2. 2007/11/27
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    I recently had to reformat, due to vista files get corrupted after a crash. This is my current log, could you tell me if you see any spyware. The only thing i think is suspicious is the svehost.exe files.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:26:37 AM, on 11/27/2007
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16546)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Windows\System32\mobsync.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Users\Jebara\Desktop\JV16Power Tools 2007\jv16 PowerTools v1.7.0.411.exe
    C:\Users\Jebara\AppData\Local\Temp\RarSFX0\jv16PT.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe "
    O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\Windows\system32\perfs.exe
    O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
    O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe

    --
    End of file - 6570 bytes
     
    cryptmagic,
    #2


  3. to hide this advert.

  4. 2007/11/27
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi cryptmagic
    Welcome to Windowsbbs.:)

    I see no virus protection on your computer, Are you not running any type of virus protection?

    If not, Go here and download either AVG or Avast, they are free. Only download and install one 1
    http://www.windowsbbs.com/showthread.php?t=67958
    Update it and run a full scan on your computer quarantine/delete anything it finds.

    You have at least two infections.
    At this point I'm not sure if there are any info stealers.
    I would suggest you change all passwords using a Non-infected computer (Not this one) and refrain from any credit card or financial dealings until clean. If you do any financial dealings with this computer Contact any credit card or banks for possible fraud on your account.


    Here is info on SVEHOSTS
    http://www.sophos.com/security/analyses/w32rbotgrw.html

    After installing a AV and doing a full scan, repost a new HJT log and a log from this.

    Please download Deckard's System Scanner (dss.exe) and save it to your Desktop.
    Note: You must be logged onto an account with administrator privileges to complete the following.
    • Close all other windows before proceeding.
    • Double-click on dss.exe and follow the prompts.
    • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy and then paste the contents of main.txt and extra.txt in your next reply.

    Geri
     
    Geri,
    #3
  5. 2007/11/28
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    Update -Main-txt

    Oh i use Windows OneCare. I did some cleaning up, to find the spyware, and then ran these scans. I also ran spybot. Every now and then Microsoft finds a trojan and quarantines it. I think there gone, but not sure. I tried rerunning it again for the extra.txt didnt appear after the first time.

    Deckard's System Scanner v20071014.68
    Run by Jebara on 2007-11-28 12:52:39
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------



    -- HijackThis (run as Jebara.exe) ----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:52:42 PM, on 11/28/2007
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16546)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SCDYIE\dss[1].exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Jebara.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe "
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPAHelper.exe - Unknown owner - C:\Program Files\iPod Access for Windows\iPAHelper.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\Windows\system32\perfs.exe (file missing)
    O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
    O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe

    --
    End of file - 6657 bytes

    -- Files created between 2007-10-28 and 2007-11-28 -----------------------------

    2007-11-28 08:27:57 0 d-------- C:\Windows\Sun
    2007-11-27 10:55:10 0 d-------- C:\Program Files\Common Files\Stardock
    2007-11-27 10:55:01 0 d-------- C:\Program Files\Stardock
    2007-11-27 08:31:41 0 d-------- C:\Users\All Users\Spybot - Search & Destroy
    2007-11-27 08:26:27 0 d-------- C:\Program Files\Trend Micro
    2007-11-27 08:17:55 0 d-------- C:\Program Files\iPod
    2007-11-27 08:17:46 0 d-------- C:\Program Files\iTunes
    2007-11-27 08:16:34 0 d-------- C:\Program Files\QuickTime
    2007-11-27 08:16:33 0 d-------- C:\Users\All Users\Apple Computer
    2007-11-27 08:16:09 0 d-------- C:\Program Files\Apple Software Update
    2007-11-27 08:15:33 0 d-------- C:\Program Files\Common Files\Apple
    2007-11-27 08:15:32 0 d-------- C:\Users\All Users\Apple
    2007-11-27 08:11:49 8 -rah----- C:\Users\Jebara\hwid
    2007-11-27 07:56:59 0 d-------- C:\Users\All Users\Nero
    2007-11-27 07:56:59 0 d-------- C:\Program Files\Nero
    2007-11-27 07:56:59 0 d-------- C:\Program Files\Common Files\Nero
    2007-11-27 07:39:33 0 d-------- C:\Users\All Users\Intuit
    2007-11-27 07:39:32 0 d-------- C:\Program Files\Quicken Rental Property Manager
    2007-11-27 07:35:03 0 d-------- C:\Program Files\TradeLog
    2007-11-26 23:06:54 0 d-------- C:\Windows\Debug
    2007-11-26 23:06:10 0 d-------- C:\Windows\Prefetch
    2007-11-26 23:06:05 0 d--hs---- C:\System Volume Information
    2007-11-26 23:05:43 0 d-------- C:\Windows\Panther
    2007-11-26 23:05:30 0 d--hs---- C:\Boot
    2007-11-26 23:05:19 0 d-------- C:\Windows\system32\OEM
    2007-11-26 23:05:19 36 -rah----- C:\Windows\DELL_VERSION
    2007-11-26 21:58:47 0 d-------- C:\Program Files\SplashData
    2007-11-26 21:42:46 256 --a------ C:\Windows\system32\pool.bin
    2007-11-26 21:34:05 0 d-------- C:\Program Files\MSXML 4.0
    2007-11-26 21:29:29 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2007-11-26 21:21:09 0 d-------- C:\Users\All Users\InstallShield
    2007-11-26 21:20:47 0 d-------- C:\Program Files\uTorrent
    2007-11-26 21:20:45 0 d-------- C:\Users\All Users\Sonic
    2007-11-26 21:17:59 0 d-------- C:\Program Files\Common Files\Sonic Shared
    2007-11-26 21:17:58 0 d-------- C:\Users\All Users\Roxio
    2007-11-26 21:17:58 0 d-------- C:\Program Files\Roxio
    2007-11-26 21:17:56 0 d-------- C:\Program Files\Common Files\Roxio Shared
    2007-11-26 21:14:26 0 d-------- C:\Program Files\Common Files\Research In Motion
    2007-11-26 21:14:19 0 d-------- C:\Program Files\Research In Motion
    2007-11-26 21:03:08 27136 --a------ C:\Windows\toFront.dll
    2007-11-26 21:03:08 26624 --a------ C:\Windows\GetIe.dll
    2007-11-26 21:03:07 0 d-------- C:\Jts
    2007-11-26 21:02:16 0 d-------- C:\Program Files\Microsoft Works
    2007-11-26 21:00:39 0 d-------- C:\Program Files\Microsoft.NET
    2007-11-26 20:58:43 0 d-------- C:\Program Files\Microsoft Visual Studio 8
    2007-11-26 20:57:37 0 d-------- C:\Users\All Users\Microsoft Help
    2007-11-26 20:57:14 0 dr-h----- C:\MSOCache
    2007-11-26 20:51:48 0 d-------- C:\Program Files\LimeWire
    2007-11-26 20:51:03 0 d-------- C:\Program Files\Collectorz.com
    2007-11-26 20:49:44 0 d-------- C:\Program Files\iPod Access for Windows
    2007-11-26 20:49:02 0 d-------- C:\Program Files\Ventrilo
    2007-11-26 20:48:16 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2007-11-26 20:46:04 45056 --a------ C:\Windows\system32\Indt2.sys <Not Verified; a; Microsoft Internet Explorer>
    2007-11-26 20:46:03 257536 --a------ C:\Windows\system32\ndt2.sys
    2007-11-26 20:44:06 506368 -----n--- C:\Windows\system32\msxml.dll <Not Verified; Microsoft Corporation; Microsoft XML Core Services>
    2007-11-26 20:43:46 0 d-a------ C:\Users\All Users\TEMP
    2007-11-26 20:43:44 0 d-------- C:\Users\All Users\Adobe
    2007-11-26 20:43:36 0 d-------- C:\Program Files\Common Files\Adobe
    2007-11-26 20:42:15 0 d-------- C:\Program Files\World of Warcraft
    2007-11-26 20:42:15 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
    2007-11-26 20:37:54 0 d-------- C:\Program Files\Common Files\PX Storage Engine
    2007-11-26 20:35:52 0 d-------- C:\Program Files\Java
    2007-11-26 20:35:50 0 d-------- C:\Program Files\Common Files\Java
    2007-11-26 20:35:15 0 d-------- C:\Users\All Users\LogiShrd
    2007-11-26 20:34:39 0 d-------- C:\Users\All Users\NVIDIA
    2007-11-26 20:23:22 0 d-------- C:\Users\All Users\Creative Labs
    2007-11-26 20:22:10 0 d-------- C:\Program Files\Common Files\Creative Labs Shared
    2007-11-26 20:22:04 0 d-------- C:\Program Files\Creative
    2007-11-26 20:22:02 0 d-------- C:\NVIDIA
    2007-11-26 20:21:07 0 d-------- C:\brother
    2007-11-26 20:20:31 69632 --a------ C:\Windows\system32\KemXML.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
    2007-11-26 20:20:31 110592 --a------ C:\Windows\system32\KemWnd.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
    2007-11-26 20:20:31 135168 --a------ C:\Windows\system32\KemUtil.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
    2007-11-26 20:20:31 163840 --a------ C:\Windows\system32\kemutb.dll <Not Verified; Logitech Inc.; Logitech SetPoint>
    2007-11-26 20:20:30 0 d-------- C:\Program Files\SigmaTel
    2007-11-26 20:20:30 0 d-------- C:\Program Files\Common Files\Logitech
    2007-11-26 20:20:27 0 d-------- C:\Users\All Users\Logitech
    2007-11-26 20:20:26 0 d-------- C:\Program Files\Logitech
    2007-11-26 20:20:26 0 d-------- C:\Program Files\Common Files\InstallShield
    2007-11-26 20:20:25 0 d--h----- C:\Program Files\InstallShield Installation Information
    2007-11-26 20:20:24 0 d-------- C:\dell
    2007-11-26 20:19:38 0 d-------- C:\Program Files\CCleaner
    2007-11-26 20:19:31 0 d------c- C:\Windows\system32\DRVSTORE
    2007-11-26 20:19:08 0 d-------- C:\Program Files\Recode Media
    2007-11-26 20:16:50 0 d-------- C:\Windows\PCHEALTH
    2007-11-26 20:16:49 0 d--hs---- C:\Windows\Installer
    2007-11-26 20:16:01 0 d-------- C:\Program Files\Microsoft Windows OneCare Live
    2007-11-26 20:14:16 0 d-------- C:\Program Files\SystemRequirementsLab
    2007-11-26 20:13:57 0 d-------- C:\Windows\system32\Macromed
    2007-11-26 20:13:00 0 dr------- C:\Users\Jebara\Searches
    2007-11-26 20:12:53 0 dr------- C:\Users\Jebara\Contacts
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Videos
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\Templates
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\Start Menu
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\SendTo
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Saved Games
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\Recent
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\PrintHood
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Pictures
    2007-11-26 20:12:48 2097152 --ahs---- C:\Users\Jebara\NTUSER.DAT
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\NetHood
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\My Documents
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Music
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\Local Settings
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Links
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Favorites
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Downloads
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Documents
    2007-11-26 20:12:48 0 dr------- C:\Users\Jebara\Desktop
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\Cookies
    2007-11-26 20:12:48 0 d--hs---- C:\Users\Jebara\Application Data
    2007-11-26 20:12:48 0 d--h----- C:\Users\Jebara\AppData
    2007-11-26 20:07:48 0 d-------- C:\Windows\SoftwareDistribution


    -- Find3M Report ---------------------------------------------------------------

    2007-11-27 23:28:16 0 d-------- C:\Users\Jebara\AppData\Roaming\uTorrent
    2007-11-27 11:30:26 0 d-------- C:\Users\Jebara\AppData\Roaming\Adobe
    2007-11-27 10:55:10 0 d-------- C:\Program Files\Common Files
    2007-11-27 08:20:16 0 d-------- C:\Users\Jebara\AppData\Roaming\Media Player Classic
    2007-11-27 08:18:43 0 d-------- C:\Users\Jebara\AppData\Roaming\Apple Computer
    2007-11-27 08:01:17 0 d-------- C:\Users\Jebara\AppData\Roaming\Nero
    2007-11-27 07:39:45 0 d-------- C:\Users\Jebara\AppData\Roaming\Intuit
    2007-11-26 21:43:28 0 d-------- C:\Users\Jebara\AppData\Roaming\Blackberry Desktop
    2007-11-26 21:42:44 0 d-------- C:\Users\Jebara\AppData\Roaming\Research In Motion
    2007-11-26 21:01:57 0 d-------- C:\Program Files\MSBuild
    2007-11-26 20:59:59 0 d-------- C:\Users\Jebara\AppData\Roaming\Ventrilo
    2007-11-26 20:50:31 163 --a------ C:\Users\Jebara\AppData\Roaming\iPod Access v4 Prefs
    2007-11-26 20:50:27 42 --ah----- C:\Users\Jebara\AppData\Roaming\iPodAccessv4_OwnerName
    2007-11-26 20:50:07 11 --ah----- C:\Users\Jebara\AppData\Roaming\iPodAccess_Time
    2007-11-26 20:34:54 0 d-------- C:\Users\Jebara\AppData\Roaming\Logitech
    2007-11-26 20:33:44 174 --ahs---- C:\Program Files\desktop.ini
    2007-11-26 20:31:03 0 d-------- C:\Program Files\Windows Calendar
    2007-11-26 20:31:02 0 d-------- C:\Program Files\Windows Mail
    2007-11-26 20:31:01 0 d-------- C:\Program Files\Windows Defender
    2007-11-26 20:20:13 0 d-------- C:\Users\Jebara\AppData\Roaming\InstallShield
    2007-11-26 20:18:46 0 d-------- C:\Users\Jebara\AppData\Roaming\WinRAR
    2007-11-26 20:13:57 0 d-------- C:\Users\Jebara\AppData\Roaming\Macromedia
    2007-11-26 20:12:54 0 d-------- C:\Users\Jebara\AppData\Roaming\Identities
    2007-09-17 15:08:06 60273 --a------ C:\Windows\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; >
    2007-09-10 13:17:58 10752 --a------ C:\Windows\system32\ff_vfw.dll
    2007-09-03 08:35:28 966656 --a------ C:\Windows\system32\VSFilter.dll <Not Verified; Gabest; VSFilter>


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [11/26/2007 08:28 PM]
    "SigmatelSysTrayApp "= "C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [05/06/2007 05:10 PM]
    "NvSvc "= "C:\Windows\system32\nvsvc.dll" [10/04/2007 05:14 PM]
    "NvCplDaemon "= "C:\Windows\system32\NvCpl.dll" [10/04/2007 05:14 PM]
    "NvMediaCenter "= "C:\Windows\system32\NvMcTray.dll" [10/04/2007 05:14 PM]
    "OneCareUI "= "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [10/31/2007 01:18 PM]
    "@ "=" " []
    "Kernel and Hardware Abstraction Layer "= "KHALMNPR.EXE" [04/11/2007 03:32 PM C:\Windows\KHALMNPR.Exe]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [11/14/2007 11:43 PM]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [11/15/2007 01:11 PM]

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [11/26/2007 9:25:25 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "=2 (0x2)
    "EnableLUA "=0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
    @= "Driver "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
    @= "Driver "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
    @= "IEEE 1394 Bus host controllers "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
    @= "SBP2 IEEE 1394 Devices "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
    @= "SecurityDevices "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    C:\Windows\system32\unregmp2.exe /ShowWMP

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



    -- End of Deckard's System Scanner: finished at 2007-11-28 12:53:06 ------------
     
    cryptmagic,
    #4
  6. 2007/11/28
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi cryptmagic

    OK, Missed One Care when I was looking through your log.

    Please do the following.

    Go to Start>Run and type (or paste) the following then hit enter.

    sc stop perfmons

    then do;

    sc delete perfmons


    Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these files (if present):

    C:\Windows\system32\perfs.exe
    C:\Windows\system32\Indt2.sys
    C:\Windows\system32\ndt2.sys

    After that, Reboot.


    Having p2p file sharing apps such as Limewire, BitTorrent uTorrent etc.. is almost like inviting malware into your computer. There is absolutely no way for you to know which of the hundreds of thousands of users you are sharing files with are infected or not.
    I strongly recommend removing any P2P applications.


    Now lets get a on-line scan.

    Please go HERE to run Panda's ActiveScan
    • Once you are on the Panda site click the Scan your PC button
    • A new window will open...click the Check Now button
    • Enter your Country
    • Enter your State/Province
    • Enter your e-mail address and click send
    • Select either Home User or Company
    • Click the big Scan Now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • When download is complete, click on My Computer to start the scan
    • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

    Please Post the Panda Log and a New HJT log.

    Thanks
    Geri
     
    Geri,
    #5
  7. 2007/11/28
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    I deleted the files you mentioned, but panda scan doesnt work with windows vista.
     
    cryptmagic,
    #6
  8. 2007/11/29
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi cryptmagic
    WOW, OK I wasn't aware of that. Thought everyone would have upgraded by now:rolleyes:

    I believe Kaspersky will work...If I read correctly. So lets try that one.

    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.

    Thanks
    Geri
     
    Geri,
    #7
  9. 2007/11/30
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    KASPERSKY ONLINE SCANNER REPORT
    Friday, November 30, 2007 1:31:38 PM
    Operating System: Microsoft Windows Vista Home Edition, (Build 6000)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 30/11/2007
    Kaspersky Anti-Virus database records: 469480


    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true

    Scan Target My Computer
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\
    J:\

    Scan Statistics
    Total number of scanned objects 87775
    Number of viruses found 4
    Number of infected objects 4
    Number of suspicious objects 0
    Duration of the scan process 00:48:55

    Infected Object Name Virus Name Last Action
    C:\$Recycle.Bin\S-1-5-21-531452519-3868007085-295059649-1000\$ROP02Q3.sys Infected: Trojan-Clicker.Win32.VB.vv skipped

    C:\$Recycle.Bin\S-1-5-21-531452519-3868007085-295059649-1000\$RSH2TOM.sys Infected: Trojan-Downloader.Win32.Delf.ddk skipped

    C:\Boot\BCD Object is locked skipped

    C:\Boot\BCD.LOG Object is locked skipped

    C:\Deckard\System Scanner\20071128125236\backup\Users\Jebara\AppData\Local\Temp\NERO14105\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped

    C:\Jts\dhggsdtwt\Fri.audit.xml Object is locked skipped

    C:\Jts\log.Fri.txt Object is locked skipped

    C:\Program Files\Internet Explorer\2.exe Infected: Trojan-Dropper.Win32.Agent.cuj skipped

    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Ent.dat Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\prov.xml Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml.bak Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml.bak Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\SubInfo.xml Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\Database\edb.log Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\Database\tmp.edb Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\mps_log.bin Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\onecaremp_log.bin Object is locked skipped

    C:\Program Files\Microsoft Windows OneCare Live\WinSSSvc_log.bin Object is locked skipped

    C:\Program Files\Nero\Nero8\Nero BackItUp\BIU83BF.txt Object is locked skipped

    C:\Program Files\World of Warcraft\Logs\gx.log Object is locked skipped

    C:\Program Files\World of Warcraft\Logs\SESound.log Object is locked skipped

    C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

    C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

    C:\ProgramData\Microsoft\OneCare Protection\Support\MPLog-11262007-203752.log Object is locked skipped

    C:\ProgramData\Microsoft\Protection Service\edb.log Object is locked skipped

    C:\ProgramData\Microsoft\Protection Service\edbtmp.log Object is locked skipped

    C:\ProgramData\Microsoft\Protection Service\MPSSVCInfoLog.etl Object is locked skipped

    C:\ProgramData\Microsoft\Protection Service\MPSSVCPolicyIdLog.etl Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.3.Crwl Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.3.gthr Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wsb Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010013.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010014.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy5.gthr Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\Ntf8CD3.tmp Object is locked skipped

    C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\Ntf8CD4.tmp Object is locked skipped

    C:\ProgramData\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped

    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Outlook\Outlook.pst Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Outlook\~Outlook.pst.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{05D16075-047F-404E-BCE3-EF8E6731F463}.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{392D1601-048C-4276-837B-686E69B263BB}.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D9E6F26A-E33F-4AD8-B790-7D52820E1DA1}.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TM.blf Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

    C:\Users\Jebara\AppData\Local\Temp\hsperfdata_Jebara\2552 Object is locked skipped

    C:\Users\Jebara\AppData\Local\Temp\~DFE9FE.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Temp\~DFEA03.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Temp\~DFEA2D.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Temp\~DFEA32.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Temp\~DFEDB5.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Local\Temp\~DFEDD9.tmp Object is locked skipped

    C:\Users\Jebara\AppData\Roaming\Microsoft\Outlook\Outlook.srs Object is locked skipped

    C:\Users\Jebara\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm Object is locked skipped

    C:\Users\Jebara\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped

    C:\Users\Jebara\NTUSER.DAT Object is locked skipped

    C:\Users\Jebara\ntuser.dat.LOG1 Object is locked skipped

    C:\Users\Jebara\ntuser.dat.LOG2 Object is locked skipped

    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped

    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

    C:\Windows\Debug\PASSWD.LOG Object is locked skipped

    C:\Windows\Debug\sam.log Object is locked skipped

    C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WindowsUpdate.log Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT Object is locked skipped

    C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 Object is locked skipped

    C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 Object is locked skipped

    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped

    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

    C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped

    C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

    C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

    C:\Windows\System32\catroot2\edb.log Object is locked skipped

    C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped

    C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped

    C:\Windows\System32\config\COMPONENTS Object is locked skipped

    C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped

    C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped

    C:\Windows\System32\config\DEFAULT Object is locked skipped

    C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped

    C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped

    C:\Windows\System32\config\RegBack\COMPONENTS Object is locked skipped

    C:\Windows\System32\config\RegBack\DEFAULT Object is locked skipped

    C:\Windows\System32\config\RegBack\SAM Object is locked skipped

    C:\Windows\System32\config\RegBack\SECURITY Object is locked skipped

    C:\Windows\System32\config\RegBack\SOFTWARE Object is locked skipped

    C:\Windows\System32\config\RegBack\SYSTEM Object is locked skipped

    C:\Windows\System32\config\SAM Object is locked skipped

    C:\Windows\System32\config\SAM.LOG1 Object is locked skipped

    C:\Windows\System32\config\SAM.LOG2 Object is locked skipped

    C:\Windows\System32\config\SECURITY Object is locked skipped

    C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped

    C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped

    C:\Windows\System32\config\SOFTWARE Object is locked skipped

    C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped

    C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped

    C:\Windows\System32\config\SYSTEM Object is locked skipped

    C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped

    C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped

    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped

    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped

    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped

    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms Object is locked skipped

    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms Object is locked skipped

    C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped

    C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

    C:\Windows\System32\Msdtc\KtmRmTm.blf Object is locked skipped

    C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000001 Object is locked skipped

    C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000002 Object is locked skipped

    C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped

    C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped

    C:\Windows\System32\wbem\Repository\INDEX.BTR Object is locked skipped

    C:\Windows\System32\wbem\Repository\MAPPING1.MAP Object is locked skipped

    C:\Windows\System32\wbem\Repository\MAPPING2.MAP Object is locked skipped

    C:\Windows\System32\wbem\Repository\OBJECTS.DATA Object is locked skipped

    C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.002 Object is locked skipped

    C:\Windows\System32\wfp\wfpdiag.etl Object is locked skipped

    C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\MSFWSVC.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped

    C:\Windows\System32\winevt\Logs\Windows OneCare.evtx Object is locked skipped

    C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped

    C:\Windows\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    cryptmagic,
    #8
  10. 2007/11/30
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    I am using Onecare am i better of finding a different Anti virus program? Say Kaspersky? or is there a better one?
     
    cryptmagic,
    #9
  11. 2007/11/30
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi cryptmagic
    Boy, asking that would just open up a big can of worms. :rolleyes:
    It is a matter of opinion which AV is good, best, or better. As long as you have a reputable AV you are fine.

    Did you take note of this???
    Having p2p file sharing apps such as Limewire, BitTorrent, uTorrent etc.. is almost like inviting malware into your computer. There is absolutely no way for you to know which of the hundreds of thousands of users you are sharing files with are infected or not.
    I strongly recommend removing any P2P applications.

    Please do this.

    Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these files (if present):

    C:\Program Files\Internet Explorer\2.exe


    Now I see you have CCleaner. Please run it now, then go straight back to Kasperskys and run another scan and post the new results.

    Thanks
    Geri
     
    Geri,
    #10
  12. 2007/12/02
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    I rarely use Limewire, and make sure that its closed at all times. I think my infection came download a program, and having spyware hidden in it. Here is the log.

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Sunday, December 02, 2007 6:27:12 PM
    Operating System: Microsoft Windows Vista Home Edition, (Build 6000)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 2/12/2007
    Kaspersky Anti-Virus database records: 470520
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\

    Scan Statistics:
    Total number of scanned objects: 83890
    Number of viruses found: 1
    Number of infected objects: 1
    Number of suspicious objects: 0
    Duration of the scan process: 00:56:24

    Infected Object Name / Virus Name / Last Action
    C:\Deckard\System Scanner\20071128125236\backup\Users\Jebara\AppData\Local\Temp\NERO14105\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Ent.dat Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\prov.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml.bak Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml.bak Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\SubInfo.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\Database\edb.log Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\Database\tmp.edb Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\mps_log.bin Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\onecaremp_log.bin Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\WinSSSvc_log.bin Object is locked skipped
    C:\Program Files\Nero\Nero8\Nero BackItUp\BIU7741.txt Object is locked skipped
    C:\Program Files\World of Warcraft\Logs\gx.log Object is locked skipped
    C:\Program Files\World of Warcraft\Logs\SESound.log Object is locked skipped
    C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\ProgramData\Microsoft\OneCare Protection\Support\MPLog-11262007-203752.log Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\edb.log Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\edbtmp.log Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\MPSSVCInfoLog.etl Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\MPSSVCPolicyIdLog.etl Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.4.Crwl Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.4.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wsb Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010012.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy8.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\Ntf7F8B.tmp Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\Ntf7F9B.tmp Object is locked skipped
    C:\ProgramData\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Outlook\Outlook.pst Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Outlook\~Outlook.pst.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012007120220071203\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8AF676EC-D718-4D8F-B7CF-36A8A2A2F43E}.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TM.blf Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF6015.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF601F.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF604D.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF6057.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF606A.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF6074.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Roaming\Microsoft\Outlook\Outlook.srs Object is locked skipped
    C:\Users\Jebara\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm Object is locked skipped
    C:\Users\Jebara\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT Object is locked skipped
    C:\Users\Jebara\ntuser.dat.LOG1 Object is locked skipped
    C:\Users\Jebara\ntuser.dat.LOG2 Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\Debug\PASSWD.LOG Object is locked skipped
    C:\Windows\Debug\sam.log Object is locked skipped
    C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped
    C:\Windows\Logs\DPX\setupact.log Object is locked skipped
    C:\Windows\Logs\DPX\setuperr.log Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WindowsUpdate.log Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped
    C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped
    C:\Windows\System32\catroot2\edb.log Object is locked skipped
    C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped
    C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped
    C:\Windows\System32\config\COMPONENTS Object is locked skipped
    C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped
    C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped
    C:\Windows\System32\config\DEFAULT Object is locked skipped
    C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped
    C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped
    C:\Windows\System32\config\RegBack\COMPONENTS Object is locked skipped
    C:\Windows\System32\config\RegBack\DEFAULT Object is locked skipped
    C:\Windows\System32\config\RegBack\SAM Object is locked skipped
    C:\Windows\System32\config\RegBack\SECURITY Object is locked skipped
    C:\Windows\System32\config\RegBack\SOFTWARE Object is locked skipped
    C:\Windows\System32\config\RegBack\SYSTEM Object is locked skipped
    C:\Windows\System32\config\SAM Object is locked skipped
    C:\Windows\System32\config\SAM.LOG1 Object is locked skipped
    C:\Windows\System32\config\SAM.LOG2 Object is locked skipped
    C:\Windows\System32\config\SECURITY Object is locked skipped
    C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped
    C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped
    C:\Windows\System32\config\SOFTWARE Object is locked skipped
    C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped
    C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped
    C:\Windows\System32\config\SYSTEM Object is locked skipped
    C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped
    C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped
    C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms Object is locked skipped
    C:\Windows\System32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
    C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped
    C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\Windows\System32\Msdtc\KtmRmTm.blf Object is locked skipped
    C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000001 Object is locked skipped
    C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000002 Object is locked skipped
    C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT Object is locked skipped
    C:\Windows\System32\SMI\Store\Machine\schema.dat.LOG1 Object is locked skipped
    C:\Windows\System32\SMI\Store\Machine\schema.dat.LOG2 Object is locked skipped
    C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT{3a53986d-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT{3a53986d-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT{3a53986d-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped
    C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped
    C:\Windows\System32\wbem\Repository\INDEX.BTR Object is locked skipped
    C:\Windows\System32\wbem\Repository\MAPPING1.MAP Object is locked skipped
    C:\Windows\System32\wbem\Repository\MAPPING2.MAP Object is locked skipped
    C:\Windows\System32\wbem\Repository\OBJECTS.DATA Object is locked skipped
    C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.001 Object is locked skipped
    C:\Windows\System32\wfp\wfpdiag.etl Object is locked skipped
    C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\MSFWSVC.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Windows OneCare.evtx Object is locked skipped
    C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped
    C:\Windows\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    cryptmagic,
    #11
  13. 2007/12/02
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi cryptmagic
    OK good, the only thing it found is Deckard. So lets clean up'

    Please delete dss.exe from your desk top

    and this folder.

    C:\Deckard

    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

    Please run one more scan at Kasperskys and make sure it finds nothing.

    Let me know.

    Geri
     
    Geri,
    #12
  14. 2007/12/03
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Monday, December 03, 2007 12:07:35 PM
    Operating System: Microsoft Windows Vista Home Edition, (Build 6000)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 3/12/2007
    Kaspersky Anti-Virus database records: 471044
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\
    J:\

    Scan Statistics:
    Total number of scanned objects: 83776
    Number of viruses found: 0
    Number of infected objects: 0
    Number of suspicious objects: 0
    Duration of the scan process: 00:40:31

    Infected Object Name / Virus Name / Last Action
    C:\Boot\BCD Object is locked skipped
    C:\Boot\BCD.LOG Object is locked skipped
    C:\Jts\dhggsdtwt\Mon.audit.xml Object is locked skipped
    C:\Jts\log.Mon.txt Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Ent.dat Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\prov.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml.bak Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml.bak Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\ClientSD\SubInfo.xml Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\Database\edb.log Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\Database\tmp.edb Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\mps_log.bin Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\onecaremp_log.bin Object is locked skipped
    C:\Program Files\Microsoft Windows OneCare Live\WinSSSvc_log.bin Object is locked skipped
    C:\Program Files\Nero\Nero8\Nero BackItUp\BIUA0FF.txt Object is locked skipped
    C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\ProgramData\Microsoft\OneCare Protection\Support\MPLog-11262007-203752.log Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\edb.log Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\edbtmp.log Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\MPSSVCInfoLog.etl Object is locked skipped
    C:\ProgramData\Microsoft\Protection Service\MPSSVCPolicyIdLog.etl Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.5.Crwl Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.5.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001002D.ci Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001002D.wid Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001002D.wsb Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy11.gthr Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\NtfA830.tmp Object is locked skipped
    C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\NtfA831.tmp Object is locked skipped
    C:\ProgramData\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Outlook\Outlook.pst Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Outlook\~Outlook.pst.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012007120320071204\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A3B23168-7D6D-4723-B55C-5531EA847093}.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TM.blf Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Microsoft\Windows\UsrClass.dat{60ed00ae-9c85-11dc-8b6f-0019d16ace88}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\hsperfdata_Jebara\2932 Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF628F.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF62A2.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF62DF.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF62E7.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF6310.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Local\Temp\~DF6316.tmp Object is locked skipped
    C:\Users\Jebara\AppData\Roaming\Microsoft\Outlook\Outlook.srs Object is locked skipped
    C:\Users\Jebara\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm Object is locked skipped
    C:\Users\Jebara\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT Object is locked skipped
    C:\Users\Jebara\ntuser.dat.LOG1 Object is locked skipped
    C:\Users\Jebara\ntuser.dat.LOG2 Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Users\Jebara\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\Debug\PASSWD.LOG Object is locked skipped
    C:\Windows\Debug\sam.log Object is locked skipped
    C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WindowsUpdate.log Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT{3a539869-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{3a539865-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\SoftwareDistribution\EventCache\{0A1481D2-9D43-4951-AE44-FB591BB2ED7B}.bin Object is locked skipped
    C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped
    C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped
    C:\Windows\System32\catroot2\edb.log Object is locked skipped
    C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped
    C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped
    C:\Windows\System32\config\COMPONENTS Object is locked skipped
    C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped
    C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped
    C:\Windows\System32\config\DEFAULT Object is locked skipped
    C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped
    C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped
    C:\Windows\System32\config\RegBack\COMPONENTS Object is locked skipped
    C:\Windows\System32\config\RegBack\DEFAULT Object is locked skipped
    C:\Windows\System32\config\RegBack\SAM Object is locked skipped
    C:\Windows\System32\config\RegBack\SECURITY Object is locked skipped
    C:\Windows\System32\config\RegBack\SOFTWARE Object is locked skipped
    C:\Windows\System32\config\RegBack\SYSTEM Object is locked skipped
    C:\Windows\System32\config\SAM Object is locked skipped
    C:\Windows\System32\config\SAM.LOG1 Object is locked skipped
    C:\Windows\System32\config\SAM.LOG2 Object is locked skipped
    C:\Windows\System32\config\SECURITY Object is locked skipped
    C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped
    C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped
    C:\Windows\System32\config\SOFTWARE Object is locked skipped
    C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped
    C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped
    C:\Windows\System32\config\SYSTEM Object is locked skipped
    C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped
    C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms Object is locked skipped
    C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms Object is locked skipped
    C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped
    C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\Windows\System32\Msdtc\KtmRmTm.blf Object is locked skipped
    C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000001 Object is locked skipped
    C:\Windows\System32\Msdtc\KtmRmTmContainer00000000000000000002 Object is locked skipped
    C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped
    C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped
    C:\Windows\System32\wbem\Repository\INDEX.BTR Object is locked skipped
    C:\Windows\System32\wbem\Repository\MAPPING1.MAP Object is locked skipped
    C:\Windows\System32\wbem\Repository\MAPPING2.MAP Object is locked skipped
    C:\Windows\System32\wbem\Repository\OBJECTS.DATA Object is locked skipped
    C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.002 Object is locked skipped
    C:\Windows\System32\wfp\wfpdiag.etl Object is locked skipped
    C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\MSFWSVC.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped
    C:\Windows\System32\winevt\Logs\Windows OneCare.evtx Object is locked skipped
    C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped
    C:\Windows\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    cryptmagic,
    #13
  15. 2007/12/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi cryptmagic
    OK very good:) Good Job.
    Number of viruses found: 0
    Number of infected objects: 0
    Number of suspicious objects: 0

    Please look at this link for some preventive recommendations, It could keep you from ending up back here to the Spyware and Virus Removal Forms.
    http://www.windowsbbs.com/showthread.php?t=67958

    Let me know that everything is running OK and I'll mark this one resolved.

    Geri
     
    Geri,
    #14
  16. 2007/12/03
    cryptmagic

    cryptmagic Inactive Thread Starter

    Joined:
    2007/11/26
    Messages:
    10
    Likes Received:
    0
    Thank You for your help.
     
    cryptmagic,
    #15

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...