Something wrong?

iHatePopUpsiHatePopUps Singapore
edited April 2006 in Spyware & Virus Removal
I recently scanned my PC with AV Scan and i found the following:

Start scanning boot sectors:

Boot sector 'C:'
[NOTE] No virus was found!

Starting to scan the registry.

The registry was scanned ( 12 files ).


Starting the file scan:

C:\Documents and Settings\Administrator\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\Administrator\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!


End of the scan: Monday, April 03, 2006 08:08
Used time: 16:57 min

Is there something wrong? These errors never appeared before when I scanned the PC in the past.

Also, i'm having some problems accessing my school site - reason being this security pop-up comes up at the login page when i'm submitting the form. It's the IE Security Alert and it keeps asking if I want to continue as the form might be sent to a unsecured site. Normally, when this comes up, i'll click 'Ok' and i'll be able to log in but since yesterday, when I click 'Ok', it pops up again and again and i'm not able to get into the site. Are the problems related? What should I do?

Comments

  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    Ok...The site, i'm able to access now. The remaining problems are as follows:



    Report file date: Monday, April 03, 2006 18:18


    Jobname: 'Local Drives'

    Scanning for 345741 virus strains and unwanted programs.

    Licensed to: AntiVir PersonalEdition Classic
    Serial number: 0000149996-WURGE-0001
    Platform: Windows XP
    Windows version: (Service Pack 2) [5.1.2600]
    Username: Administrator
    Computer name: XXX

    Version informations:
    AVSCAN.EXE : 7.0.0.30 536616 3/28/2006 14:27:44
    AVSCAN.DLL : 7.0.0.30 40488 3/28/2006 14:27:44
    LUKE.DLL : 7.0.0.30 114728 3/28/2006 14:27:44
    LUKERES.DLL : 7.0.0.30 25600 3/28/2006 14:27:44
    ANTIVIR0.VDF : 6.32.0.60 4323840 3/1/2006 07:15:46
    ANTIVIR1.VDF : 6.34.0.105 1669120 3/28/2006 14:27:45
    ANTIVIR2.VDF : 6.34.0.106 1536 3/28/2006 14:27:45
    ANTIVIR3.VDF : 6.34.0.127 40960 4/1/2006 08:43:04
    AVEWIN32.DLL : 7.0.0.3 1167872 3/18/2006 03:42:15
    AVPREF.DLL : 6.34.0.0 38440 2/23/2006 02:22:30
    AVREP.DLL : 6.34.0.100 2461736 3/27/2006 14:04:56
    AVPACK32.DLL : 6.33.0.6 331816 2/23/2006 02:22:30
    AVREG.DLL : 6.31.0.90 27688 2/23/2006 02:22:30
    NETNT.DLL : 6.32.0.0 6696 2/23/2006 02:22:32
    NETNW.DLL : 6.32.0.0 9768 2/23/2006 02:22:32


    Start of the scan: Monday, April 03, 2006 18:18


    Start scanning boot sectors:

    Boot sector 'C:'
    [NOTE] No virus was found!
    Boot sector 'A:'
    [NOTE] In the drive 'A:' no data medium is inserted!

    Starting to scan the registry.

    The registry was scanned ( 11 files ).


    Starting the file scan:

    C:\Documents and Settings\Administrator\NTUSER.DAT
    [WARNING] The file could not be opened!
    C:\Documents and Settings\Administrator\ntuser.dat.LOG
    [WARNING] The file could not be opened!
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
    [WARNING] The file could not be opened!
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
    [WARNING] The file could not be opened!
    C:\Documents and Settings\LocalService\NTUSER.DAT
    [WARNING] The file could not be opened!
    C:\Documents and Settings\LocalService\ntuser.dat.LOG
    [WARNING] The file could not be opened!
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
    [WARNING] The file could not be opened!
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
    [WARNING] The file could not be opened!
    C:\Documents and Settings\NetworkService\NTUSER.DAT
    [WARNING] The file could not be opened!
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG
    [WARNING] The file could not be opened!
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
    [WARNING] The file could not be opened!
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\default
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\default.LOG
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\SAM
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\SAM.LOG
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\SECURITY
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\SECURITY.LOG
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\software
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\software.LOG
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\system
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\config\system.LOG
    [WARNING] The file could not be opened!
    C:\WINDOWS\temp\ZLT00f5b.TMP
    [WARNING] The file could not be opened!
    The path A:\ could not be found!
    The device is not ready.



    End of the scan: Monday, April 03, 2006 19:16
    Used time: 58:02 min

    The scan has been done completely.

    12986 Scanning directories
    587982 Files were scanned
    0 viruses and/or unwanted programs was found
    0 files were deleted
    0 files were repaired
    0 files were moved to quarantine
    0 files were renamed
    2607 Archives were scanned
    46 Warnings
    3 Notes

    Wonder if this is serious? It seems like almost every file associated with Windows has a problem.. My PC's still working fine though...Someone look at it for me please? Here's a HJT log if you need it.

    Logfile of HijackThis v1.99.1
    Scan saved at 7:21:05 PM, on 4/3/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\BitTornado\btdownloadgui.exe
    C:\Program Files\BitTornado\btdownloadgui.exe
    C:\Program Files\BitTornado\btdownloadgui.exe
    C:\Program Files\BitTornado\btdownloadgui.exe
    C:\Program Files\BitTornado\btdownloadgui.exe
    C:\Program Files\BitTornado\btdownloadgui.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [KlipFolio] "C:\Program Files\KlipFolio\KlipFolio.exe" /BOOT
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A8842474-7D8D-4371-9462-79560AC4808D}: NameServer = 202.156.1.48,202.156.1.68
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: MySql - Unknown owner - C:\MySql\bin\mysqld (file missing)
    O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oracle\ora92\bin\omtsreco.exe
    O23 - Service: OracleOraHome92Agent - Oracle Corporation - C:\oracle\ora92\bin\agntsrvc.exe
    O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
    O23 - Service: OracleOraHome92HTTPServer - Unknown owner - C:\oracle\ora92\Apache\Apache\apache.exe" --ntservice (file missing)
    O23 - Service: OracleOraHome92PagingServer - Unknown owner - C:\oracle\ora92/bin/pagntsrv.exe
    O23 - Service: OracleOraHome92SNMPPeerEncapsulator - Unknown owner - C:\oracle\ora92\BIN\ENCSVC.EXE
    O23 - Service: OracleOraHome92SNMPPeerMasterAgent - Unknown owner - C:\oracle\ora92\BIN\AGNTSVC.EXE
    O23 - Service: OracleOraHome92TNSListener - Unknown owner - C:\oracle\ora92\BIN\TNSLSNR.exe
    O23 - Service: OracleServiceBEN - Oracle Corporation - c:\oracle\ora92\bin\ORACLE.EXE
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  • TroganTrogan London, UK
    edited April 2006
    Could you do a few things please.

    1)
    • Please go to Jotti's malware scan
    • Copy and paste the following file path into the "File to upload & scan" box on the top of the page:
    • C:\WINDOWS\temp\ZLT00f5b.TMP
    • Click on the submit button
    • Please post the results in your next reply.

    2)
    Run this scan please:

    Panda ActiveScan

    - Once you are on the Panda site, click the Scan your PC button
    - A new window will open...click the Check Now button
    - Enter your Country
    - Enter your State/Province
    - Enter your e-mail address and click send
    - Select either Home User or Company
    - Click the big Scan Now button
    - If it wants to install an ActiveX component allow it
    - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    - When download is complete, click on Local Disks to start the scan
    - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.


    3) Enable everything on startup and post a new HJT log, along with the Panda report and the jotti scan.

    How many user accounts do you have on the computer?
  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    Man, you're a really busy guy. Seems like you're on almost every single thread there is. Tough job huh? Hopefully there're lotsa grateful people out there. Anyway:

    C:\WINDOWS\temp\ZLT00f5b.TMP - the file initially existed when I did the Jotti uploading thingy, but when I tried to upload it, the site says i'm unable to because of a malware or a firewall. Right after the attempt to upload it, the file disappeared completely. On reloading the Jotti site, i closed ZA and AntiVirGuard and tried again (the file reappeared), and it shows the same message of a malware or firewall blocking it (file's still there though).

    I've updated ewido and scanned my C:/WINDOWS folder, registery and memory with it, but it found nothing. Updated ZA and SpywareBlaster as well (i'm on auto update for ZA :P) but thanks for the notification.

    The result of ActiveScan is as follows:


    Incident Status Location

    Potentially unwanted tool:Application/Processor Not disinfected C:\smitrem\smitRem\Process.exe
    That's all. Are the files important? How will they affect my system? (the files that couldn't be opened)
  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    Ok, here's the HJT log:

    Logfile of HijackThis v1.99.1
    Scan saved at 6:42:18 PM, on 4/4/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Apache Group\Apache2\bin\Apache.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\MySql\bin\mysqld.exe
    C:\Program Files\Apache Group\Apache2\bin\Apache.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\oracle\ora92\bin\omtsreco.exe
    C:\oracle\ora92\bin\agntsrvc.exe
    C:\WINDOWS\system32\cmd.exe
    C:\oracle\ora92\BIN\TNSLSNR.exe
    C:\oracle\ora92\bin\dbsnmp.exe
    c:\oracle\ora92\bin\ORACLE.EXE
    C:\Program Files\KlipFolio\KlipFolio.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    c:\oracle\ora92\bin\ORACLE.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\DAP\DAP.EXE
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\AntiVir PersonalEdition Classic\update.exe
    C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [KlipFolio] "C:\Program Files\KlipFolio\KlipFolio.exe" /BOOT
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A8842474-7D8D-4371-9462-79560AC4808D}: NameServer = 202.156.1.48,202.156.1.68
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: MySql - Unknown owner - C:\MySql\bin\mysqld (file missing)
    O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oracle\ora92\bin\omtsreco.exe
    O23 - Service: OracleOraHome92Agent - Oracle Corporation - C:\oracle\ora92\bin\agntsrvc.exe
    O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
    O23 - Service: OracleOraHome92HTTPServer - Unknown owner - C:\oracle\ora92\Apache\Apache\apache.exe" --ntservice (file missing)
    O23 - Service: OracleOraHome92PagingServer - Unknown owner - C:\oracle\ora92/bin/pagntsrv.exe
    O23 - Service: OracleOraHome92SNMPPeerEncapsulator - Unknown owner - C:\oracle\ora92\BIN\ENCSVC.EXE
    O23 - Service: OracleOraHome92SNMPPeerMasterAgent - Unknown owner - C:\oracle\ora92\BIN\AGNTSVC.EXE
    O23 - Service: OracleOraHome92TNSListener - Unknown owner - C:\oracle\ora92\BIN\TNSLSNR.exe
    O23 - Service: OracleServiceBEN - Oracle Corporation - c:\oracle\ora92\bin\ORACLE.EXE
    O23 - Service: OracleServiceNARU - Oracle Corporation - c:\oracle\ora92\bin\ORACLE.EXE
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    I've got 2 user accounts, both admins. I'm using the 'Administrator' account, but i created the other just in case say, I forget my password (though I doubt it'll happen!). Why?
  • TroganTrogan London, UK
    edited April 2006
    C:\WINDOWS\temp\ZLT00f5b.TMP - the file initially existed when I did the Jotti uploading thingy, but when I tried to upload it, the site says i'm unable to because of a malware or a firewall. Right after the attempt to upload it, the file disappeared completely. On reloading the Jotti site, i closed ZA and AntiVirGuard and tried again (the file reappeared), and it shows the same message of a malware or firewall blocking it (file's still there though).
    No problem.
    How will they affect my system? (the files that couldn't be opened)
    I don't think they will cause much harm. I've never seen this happen before though. :(
    I've got 2 user accounts, both admins. I'm using the 'Administrator' account, but i created the other just in case say, I forget my password (though I doubt it'll happen!). Why?
    Cause malware sometimes can be on ONE account and not the another. Make sense? If you hardly use your second account, then it shouldn't be a problem.



    Could you run this last scan and if this is clean, then I guess there is nothing to worry about.

    Kaspersky Online Virus Scan
    - Click on the Kaspersky Online Scanner button
    - On the new window that opens, click the Accept button
    - Kaspersky will check if you have the ActiveX installed. If not, you will be prompted to download it. Please do - it is perfectly safe.
    - After accepting to install the ActiveX, you will need to click Accept again
    - Kaspersky will then install the ActiveX and download the latest Anti-Virus files from their database. Please be patient, it may take several mintues to download the latest files. Click Next when done
    - Select My Computer
    Please do NOT use the internet while Kaspersky is scanning
    - When the scan is complete, click the Save as Text button. Call it Virus Results and save the report to your desktop.
    - Open the file and paste the entire contents here
  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    Everything's clean. So what do I do with the files? Leave them or delete them?
  • TroganTrogan London, UK
    edited April 2006
    If nothing turned up with the Kaspersky scan, then you should be alright. As long as the computer is running fine, there is no problem.

    Do you know what this is?

    C:\Program Files\KlipFolio\KlipFolio.exe
  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    KlipFolio is an application where you can add-on 'Klips' say like, global news or sports news and it updates itself everyday to provide you with links to official and 'unofficial' sites which provide the news. You can even see your mailbox status with it. :)
  • TroganTrogan London, UK
    edited April 2006
    OK cool!

    Is everything alright?
  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    No problems so far, though I'd like to know what those files are. But it's okay. I've been here long enough to trust you guys. Thanks for your help again! :)

    Btw, i'm a Man Utd fan too. Think they've any chance to win the EPL now?
  • TroganTrogan London, UK
    edited April 2006
    Yep, still believe we can snatch it, until we mathmatically can't win it. :D
  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    Well, I sure do hope that Ruud scores a brace against Arsenal this weekend.. And that United wins of course.. :)
  • TroganTrogan London, UK
    edited April 2006
    I'm hoping Ruud starts the match ahead of Saha. Who ever plays, we gotta win. :D

    So, what do you want to do with this thread? ;D
  • iHatePopUpsiHatePopUps Singapore
    edited April 2006
    Guess we can call it resolved then. Thanks! :)
  • TroganTrogan London, UK
    edited April 2006
    Done!

    PM me or start a new thread if you need help. :)
This discussion has been closed.