Options

Evil stuff on my pc

Unknown
edited June 2006 in Spyware & Virus Removal
My daughter is getting random popups whether she's surfing or not. also, sometimes all the IE windows will just close up. We installed bitdefender 9 and it has recognized qoologic and newdotnet garbage in the system. We ran thru the steps for qoologic and it did not help. There seems to be 3 instances of the ftfsc.exe running (which are loading with shell=explorer.exe... Even when I go to the registry and change it there to remove the additional parts from that one and the userinit one, they are instantly replaced. (even when I did it in safe mode, when it looked like nothing bad was running)

I think that is part of the problem. I also think pkoocr.exe is bad, but I can't get rid of that either.

Also, the "RUN" function on the startbutton seems to be hijacked or disabled as well. If I do regedit, or cmd, a dos prompt appears for a second and then it closes. I can explore to regedit.exe and launch it from there and it works fine... also can do a dos prompt from start/programs/accessories and works just fine.

I ran look2medestroyer, spybot s&d, adaware, spywareblaster, and the bfu process for qoologic....

I've spent about 8 hours on this so far- any advice would be appreciated. Here is our current hjt log.

Thanks
Bill



Logfile of HijackThis v1.99.1
Scan saved at 7:30:10 PM, on 6/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\pkoocr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ftfsc.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
C:\WINDOWS\system32\ftfsc.exe
C:\WINDOWS\system32\ftfsc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\DOCUME~1\Lindsey\APPLIC~1\SKS~1\mmc.exe
C:\WINDOWS\system32\?ymantec\m?dtc.exe
C:\Program Files\TClock\TClock.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\ftfsc.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,qpmvmwj.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5BFE0829-C8CD-9444-9198-E1FC5D83B4E3} - C:\WINDOWS\system32\ngvad.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {5EFF5221-9F9B-904A-9198-E1FC5D83B4E3} - C:\WINDOWS\system32\qesfigqf.dll
O2 - BHO: (no name) - {64D417FD-0CD8-460D-89B6-CDFB3432D95D} - C:\Program Files\Messenger\horebo.dll
O2 - BHO: Yvakt Class - {AE0ECC2F-0C33-494C-8B22-B57A7763027F} - C:\WINDOWS\system32\x3cqp0.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [winupdate] C:\Program Files\winupdate\winupdate.exe /auto
O4 - HKLM\..\Run: [w649e305.dll] RUNDLL32.EXE w649e305.dll,I2 0015aec20649e305
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [p2pnetworking] p2pnetworking.exe
O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [xtkqdktA] C:\WINDOWS\xtkqdktA.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [ocsgcp] C:\WINDOWS\system32\pkoocr.exe reg_run
O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [Tair] "C:\DOCUME~1\Lindsey\APPLIC~1\SKS~1\mmc.exe" -vt tzt
O4 - HKCU\..\Run: [Qgojjw] C:\WINDOWS\system32\?ymantec\m?dtc.exe
O4 - HKCU\..\Run: [lxahd] C:\WINDOWS\system32\pkoocr.exe reg_run
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: hrapi.exe
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Filter: text/html - {DA28E0DB-229C-4003-827E-96AE15AD90FB} - C:\WINDOWS\system32\x3cqp0.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Comments

  • Shaba
    edited June 2006
    Hi Zathras

    Download and unzip BFU.zip from here.
    Run the program and click the Web button as shown by the blue arrow below:
    bfuonlinescript5lf.jpg

    Use this URL to copy into the address bar of the Download script window:
    http://metallica.geekstogo.com/alcanshorty.bfu

    Execute the script by clicking the Execute button.

    If you have any questions about the use of BFU please read here:
    http://metallica.geekstogo.com/BFUinstructions.html

    Reboot

    Look in your control panels add/remove programs for PuritySCAN By OIN, OuterInfo, OIN or similar , click on it and click remove.
    Reboot and delete this folder if found:
    C:\Program Files\PurityScan

    If not listed, download and run this uninstaller:
    Uninstaller

    Tutorial for the uninstaller if needed

    Reboot when done and delete this folder if found:
    C:\Program Files\PurityScan

    Open HijackThis, click do a system scan only, checkmark these and press fix checked:

    O2 - BHO: (no name) - {5BFE0829-C8CD-9444-9198-E1FC5D83B4E3} - C:\WINDOWS\system32\ngvad.dll
    O2 - BHO: (no name) - {5EFF5221-9F9B-904A-9198-E1FC5D83B4E3} - C:\WINDOWS\system32\qesfigqf.dll
    O2 - BHO: (no name) - {64D417FD-0CD8-460D-89B6-CDFB3432D95D} - C:\Program Files\Messenger\horebo.dll
    O2 - BHO: Yvakt Class - {AE0ECC2F-0C33-494C-8B22-B57A7763027F} - C:\WINDOWS\system32\x3cqp0.dll
    O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
    O4 - HKLM\..\Run: [w649e305.dll] RUNDLL32.EXE w649e305.dll,I2 0015aec20649e305
    O4 - HKLM\..\Run: [p2pnetworking] p2pnetworking.exe
    O4 - HKLM\..\Run: [xtkqdktA] C:\WINDOWS\xtkqdktA.exe
    O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe
    O18 - Filter: text/html - {DA28E0DB-229C-4003-827E-96AE15AD90FB} - C:\WINDOWS\system32\x3cqp0.dll

    Delete if found:

    C:\WINDOWS\system32\ngvad.dll
    C:\WINDOWS\system32\qesfigqf.dll
    C:\Program Files\Messenger\horebo.dll
    C:\WINDOWS\system32\x3cqp0.dll
    C:\WINDOWS\xtkqdktA.exe

    Please do a search:
    "Run "Start">"Search">"All Files and Folders"> enter w649e305.dll in "All or part of file name". Select "More advanced options". Check-mark "Search System Folders", "Search hidden files and folders", and "Search subfolders". Click "Search". Right click the file and select delete.

    Empty Recycle Bin.

    NOTE: That file may not exist at all! If it doesn't, just skip the step above.

    Repeat step for p2pnetworking.exe

    Reboot.
    Download FindQool by LonnyRJones
    • Unzip contents to C:\ root (in other words, create folder c:\FindQool and unzip contents there)
    • Open folder and run Qlocate.bat.
    • Send contents of opening logfile here

    Send:

    - a fresh HjT log
    - findqool logfile
  • Zathras
    edited June 2006
    Log from findqool

    Mon 06/19/2006
    Running from: C:\FindQool\FindQool
    PLEASE NOTE: LEGIT FILES MIGHT BE LISTED. IF YOU ARE UNSURE OF WHAT IS LISTED LEAVE THEM ALONE.

    Known file names

    MD5 Check....

    Files found with locate com.
    C:\WINDOWS\SYSTEM32\QPMVMWJ.EXE
    C:\WINDOWS\SYSTEM32\VRNOSAU.DLL
    C:\WINDOWS\SYSTEM32\UHDRN.DAT
    C:\WINDOWS\SYSTEM32\PKOOCR.EXE
    C:\WINDOWS\SYSTEM32\FTFSC.EXE
    C:\DOCUME~1\ALLUSE~1\STARTM~1\PROGRAMS\STARTUP\HRAPI.EXE
    Re-check using dir /a:-d
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    06/18/2006 02:43 AM 127,488 hrapi.exe
    ...


    ...
    Runs, Listed here as a Doublecheck for the locate com results
    HKLM
    "ocsgcp"="C:\\WINDOWS\\system32\\pkoocr.exe reg_run"
    HKCU
    "lxahd"="C:\\WINDOWS\\system32\\pkoocr.exe reg_run"
    ...

    Files In Winlogon shell and userinit
    Listed here as a Doublecheck for the locate com results
    shell REG_SZ Explorer.exe, C:\WINDOWS\system32\ftfsc.exe
    userinit REG_SZ C:\WINDOWS\system32\Userinit.exe,qpmvmwj.exe
    ...
    SWReg utility
    Written by Bobbi Flekman © 2005
    Findqool edited 17/05/2006


    log from HjT

    Logfile of HijackThis v1.99.1
    Scan saved at 12:51:07 PM, on 6/19/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\pkoocr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ftfsc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ftfsc.exe
    C:\WINDOWS\system32\ftfsc.exe
    C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\ipwins\ipwins.exe
    C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    C:\Program Files\Softwin\BitDefender9\bdnagent.exe
    C:\Program Files\Softwin\BitDefender9\bdswitch.exe
    C:\Program Files\Softwin\BitDefender9\bdmcon.exe
    C:\Program Files\NetWaiting\netWaiting.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    C:\Program Files\TClock\TClock.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\ftfsc.exe
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,qpmvmwj.exe
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [winupdate] C:\Program Files\winupdate\winupdate.exe /auto
    O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
    O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKLM\..\Run: [ocsgcp] C:\WINDOWS\system32\pkoocr.exe reg_run
    O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
    O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
    O4 - HKCU\..\Run: [lxahd] C:\WINDOWS\system32\pkoocr.exe reg_run
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    O4 - Global Startup: hrapi.exe
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
  • Shaba
    edited June 2006
    Fix with HjT (do a system scan only, checkmark these and press fix checked):

    O4 - HKLM\..\Run: [winupdate] C:\Program Files\winupdate\winupdate.exe /auto
    O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)


    Please click Start > Run and type in: services.msc
    Click OK
    In the Services window find: Network Monitor
    Select/highlight and right click the entry, and choose: Properties
    On the General tab, under Service Status click the Stop button
    Beside: Startup Type, in the drop menu, select: Disabled
    Click Apply, then OK

    Now, go to Start > Run, and copy/paste the following into the Open box:
    sc delete "Network Monitor"
    Click: OK

    1. Please download The Avenger by Swandog46 to your Desktop.
    • Click on Avenger.zip to open the file
    • Extract avenger.exe to your desktop

    2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
    Files to delete:
    C:\WINDOWS\SYSTEM32\QPMVMWJ.EXE
    C:\WINDOWS\SYSTEM32\VRNOSAU.DLL
    C:\WINDOWS\SYSTEM32\UHDRN.DAT
    C:\WINDOWS\SYSTEM32\PKOOCR.EXE
    C:\WINDOWS\SYSTEM32\FTFSC.EXE
    C:\DOCUME~1\ALLUSE~1\STARTM~1\PROGRAMS\STARTUP\HRAPI.EXE

    Folders to delete:
    C:\Program Files\winupdate
    C:\Program Files\ipwins
    C:\Program Files\Network Monitor

    Note: Make sure that it´s HRAPI.EXE! Otherwise qoologic will come back.
    If you see space in name, correct it after pasting!


    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by clicking on its icon on your desktop.
    • Under "Script file to execute" choose "Input Script Manually".
    • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
    • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
    • Click Done
    • Now click on the Green Light to begin execution of the script
    • Answer "Yes" twice when prompted.
    4. The Avenger will automatically do the following:
    • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    • On reboot, it will briefly open a black command window on your desktop, this is normal.
    • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    Re-run findqool.

    Send:

    - a fresh HjT log
    - c:\avenger.txt
    - findqool log
  • Zathras
    edited June 2006
    HjT log

    Logfile of HijackThis v1.99.1
    Scan saved at 2:44:54 PM, on 6/19/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\savedump.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    C:\Program Files\Softwin\BitDefender9\bdnagent.exe
    C:\Program Files\Softwin\BitDefender9\bdswitch.exe
    C:\Program Files\Softwin\BitDefender9\bdmcon.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    C:\Program Files\NetWaiting\netWaiting.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\TClock\TClock.exe
    C:\WINDOWS\system32\notepad.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\DOCUME~1\Lindsey\Desktop\FindQool\FindQool\sub\md5deep.exe
    C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\ftfsc.exe
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,qpmvmwj.exe
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKLM\..\Run: [ocsgcp] C:\WINDOWS\system32\pkoocr.exe reg_run
    O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
    O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
    O4 - HKCU\..\Run: [lxahd] C:\WINDOWS\system32\pkoocr.exe reg_run
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

    Logfile of The Avenger version 1, by Swandog46
    Running from registry key:
    \Registry\Machine\System\CurrentControlSet\Services\lvshcjfd

    *******************

    Script file located at: \??\C:\sbamwnec.txt
    Script file opened successfully.

    Script file read successfully

    Backups directory opened successfully at C:\Avenger

    *******************

    Beginning to process script file:

    File C:\WINDOWS\SYSTEM32\QPMVMWJ.EXE deleted successfully.
    File C:\WINDOWS\SYSTEM32\VRNOSAU.DLL deleted successfully.
    File C:\WINDOWS\SYSTEM32\UHDRN.DAT deleted successfully.
    File C:\WINDOWS\SYSTEM32\PKOOCR.EXE deleted successfully.
    File C:\WINDOWS\SYSTEM32\FTFSC.EXE deleted successfully.
    File C:\DOCUME~1\ALLUSE~1\STARTM~1\PROGRAMS\STARTUP\HRAPI.EXE deleted successfully.


    Folder C:\Program Files\winupdate not found!
    Deletion of folder C:\Program Files\winupdate failed!

    Could not process line:
    C:\Program Files\winupdate
    Status: 0xc0000034



    Folder C:\Program Files\ipwins not found!
    Deletion of folder C:\Program Files\ipwins failed!

    Could not process line:
    C:\Program Files\ipwins
    Status: 0xc0000034



    Folder C:\Program Files\Network Monitor not found!
    Deletion of folder C:\Program Files\Network Monitor failed!

    Could not process line:
    C:\Program Files\Network Monitor
    Status: 0xc0000034


    Completed script processing.

    *******************

    Finished! Terminate.
    Mon 06/19/2006
    Running from: C:\Documents and Settings\Lindsey\Desktop\FindQool\FindQool
    PLEASE NOTE: LEGIT FILES MIGHT BE LISTED. IF YOU ARE UNSURE OF WHAT IS LISTED LEAVE THEM ALONE.

    Known file names

    MD5 Check....

    Files found with locate com.
    Re-check using dir /a:-d
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    ...


    ...
    Runs, Listed here as a Doublecheck for the locate com results
    HKLM
    "ocsgcp"="C:\\WINDOWS\\system32\\pkoocr.exe reg_run"
    HKCU
    "lxahd"="C:\\WINDOWS\\system32\\pkoocr.exe reg_run"
    ...

    Files In Winlogon shell and userinit
    Listed here as a Doublecheck for the locate com results
    shell REG_SZ Explorer.exe, C:\WINDOWS\system32\ftfsc.exe
    userinit REG_SZ C:\WINDOWS\system32\Userinit.exe,qpmvmwj.exe
    ...
    SWReg utility
    Written by Bobbi Flekman © 2005
    Findqool edited 17/05/2006
  • Shaba
    edited June 2006
    Great job :)

    Fix with HjT:

    F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\ftfsc.exe
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,qpmvmwj. exe
    O4 - HKLM\..\Run: [ocsgcp] C:\WINDOWS\system32\pkoocr.exe reg_run
    O4 - HKCU\..\Run: [lxahd] C:\WINDOWS\system32\pkoocr.exe reg_run

    Reboot

    Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:

      o Scan using the following Anti-Virus database:

      + Extended (If available otherwise Standard)

      o Scan Options:

      + Scan Archives
      + Scan Mail Bases
    • Click OK
    • Now under select a target to scan select My Computer
    • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button
    • Save the file to your desktop.
    • Copy and paste that information in your next post.

    Send:

    - a fresh HjT log
    - kaspersky report
  • Zathras
    edited June 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 12:52:37 PM, on 6/20/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    C:\Program Files\Softwin\BitDefender9\bdnagent.exe
    C:\Program Files\Softwin\BitDefender9\bdswitch.exe
    C:\Program Files\Common Files\AOL\1150784193\ee\AOLSoftware.exe
    C:\Program Files\NetWaiting\netWaiting.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\TClock\TClock.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\program files\aol\aol toolbar 3.1\aoltbhelper.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    c:\program files\softwin\bitdefender9\bdmcon.exe
    C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150784193\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
    O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
    O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
    O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
  • Zathras
    edited June 2006
    heres the kasperky report attached
  • Shaba
    edited June 2006
    Oh my god how much :(

    Boot in safe mode -> http://www.pchell.com/support/safemode.shtml

    Delete these files/directories:

    C:\Uploads
    C:\wd7gi8n.exe
    C:\WINDOWS\offun.exe
    C:\WINDOWS\srvkbctsfp.exe
    C:\WINDOWS\system32\gbe90qs.exe
    C:\WINDOWS\system32\iexplore.dll
    C:\WINDOWS\system32\tfthot.exe
    C:\WINDOWS\system32\VSL03.exe
    C:\WINDOWS\system32\VSL05.exe
    C:\WINDOWS\system32\winlogon.dll
    C:\i386
    C:\Mendoza1.exe
    C:\Program Files\Common Files\kyze.html
    C:\Program Files\Аdobe
    C:\stub_sca3.exe

    Reboot.

    Re-scan with kaspersky.

    Send:

    - a fresh HjT log
    - kaspersky report
  • Zathras
    edited June 2006
    Here is my latest hjt and kas files.. the popup windows seem to be gone, but there are still virus and trojan warnings popping up from bitdefender. kas still reports a few viruses.

    start/run/cmd and start/run/regedit still both just bring up a dos prompt momentarily and then end.

    ============================

    Logfile of HijackThis v1.99.1
    Scan saved at 7:30:49 PM, on 6/21/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    C:\program files\softwin\bitdefender9\bdnagent.exe
    C:\program files\softwin\bitdefender9\bdswitch.exe
    C:\Program Files\Common Files\AOL\1150784193\ee\AOLSoftware.exe
    C:\Program Files\NetWaiting\netWaiting.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\program files\aol\aol toolbar 3.1\aoltbhelper.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    c:\program files\softwin\bitdefender9\bdmcon.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150784193\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
    O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
    O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
    O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
    KASPERSKY ON-LINE SCANNER REPORT
    Wednesday, June 21, 2006 7:30:14 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.78.0
    Kaspersky Anti-Virus database last update: 22/06/2006
    Kaspersky Anti-Virus database records: 201884

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 43332
    Number of viruses found: 25
    Number of infected objects: 77
    Number of suspicious objects: 0
    Duration of the scan process: 00:31:47

    Infected Object Name / Virus Name / Last Action
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/FTFSC.EXE Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/PKOOCR.EXE Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/QPMVMWJ.EXE Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/UHDRN.DAT Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/VRNOSAU.DLL Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/winupdate/winupdate.exe Infected: Trojan.Win32.Crypt.e skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip ZIP: infected - 6 skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-846.dll Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-869.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-875.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temp\WSu.exe Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\81BCVP2L\OiUninstaller[1].exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\81BCVP2L\OiUninstaller[1].exe NSIS: infected - 1 skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\81BCVP2L\wallpap[1].exe Infected: Trojan-Clicker.Win32.Small.jf skipped
    C:\Program Files\Аdobe\scanregw.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\ssn6tuu.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\tfthot.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.f skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\winlogon.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\x3cqp0.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP18\A0002595.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP18\A0002720.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP19\A0002782.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP19\A0002908.exe Infected: Trojan-Downloader.Win32.PurityScan.bj skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP19\snapshot\MFEX-62.DAT Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004094.exe Infected: Trojan.Win32.Scapur.k skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004129.exe Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004130.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004130.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004130.exe CAB: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004132.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP25\A0004188.exe Infected: Trojan.Win32.StartPage.ajj skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP26\A0004545.exe Infected: Trojan.Win32.Zapchast.bl skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005170.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005171.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005173.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005173.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005173.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005174.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005174.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005174.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.u skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe UPX: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe PE_Patch.UPX: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005184.exe Infected: Trojan.Win32.StartPage.ajj skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005185.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005312.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005332.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005333.dll Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005334.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006541.exe Infected: Trojan-Downloader.Win32.Agent.ala skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006542.exe Infected: Trojan-Downloader.Win32.VB.nw skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006543.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.l skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006543.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006544.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006545.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.f skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006546.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006546.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006546.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006547.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006547.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006547.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0004 Infected: Trojan-Downloader.MSIL.Agent.a skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0010 Infected: Trojan.Win32.Zapchast.bl skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0011/data0006 Infected: Trojan-Dropper.Win32.VB.mz skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0011 Infected: Trojan-Dropper.Win32.VB.mz skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe NSIS: infected - 4 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006549.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006814.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006814.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006814.exe CAB: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0007422.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0007590.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\WINDOWS\system32\gbe90qs.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\WINDOWS\system32\ssn6tuu.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\WINDOWS\system32\winlogon.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\WINDOWS\system32tfthot.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.f skipped

    Scan process completed.
  • Shaba
    edited June 2006
    Please download ATF Cleaner by Atribune and save
    it to desktop. Don't use it yet.
    Boot in safe mode.

    Delete these:

    C:\Program Files\Аdobe
    C:\WINDOWS\system32\gbe90qs.exe
    C:\WINDOWS\system32\ssn6tuu.exe
    C:\WINDOWS\system32\winlogon.dll
    C:\WINDOWS\system32tfthot.exe

    If you can't find them, let me know.

    Empty Recycle Bin

    Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Click the Empty Selected button.

    If you use Firefox browser

    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit to close ATF-Cleaner.

    Reboot

    Re-scan with kaspersky.

    Scan with Bitdefender online scanner, see here -> http://www.short-media.com/forum/showthread.php?t=43902

    Send:

    - a fresh HjT log
    - kaspersky report
    - bitdefender report
  • Zathras
    edited June 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 7:57:05 PM, on 6/25/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    C:\Program Files\Softwin\BitDefender9\bdnagent.exe
    C:\Program Files\Softwin\BitDefender9\bdswitch.exe
    C:\Program Files\Common Files\AOL\1150784193\ee\AOLSoftware.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\Program Files\NetWaiting\netWaiting.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    C:\Program Files\TClock\TClock.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    c:\program files\softwin\bitdefender9\bdmcon.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1150784193\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
    O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
    O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.1\resources\en-US\local\search.html
    O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.1\aoltb.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)





    KASPERSKY ON-LINE SCANNER REPORT
    Sunday, June 25, 2006 6:10:30 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.78.0
    Kaspersky Anti-Virus database last update: 25/06/2006
    Kaspersky Anti-Virus database records: 202650

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 50276
    Number of viruses found: 26
    Number of infected objects: 77
    Number of suspicious objects: 0
    Duration of the scan process: 00:38:10

    Infected Object Name / Virus Name / Last Action
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/FTFSC.EXE Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/PKOOCR.EXE Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/QPMVMWJ.EXE Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/UHDRN.DAT Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/VRNOSAU.DLL Infected: Trojan-Downloader.Win32.Qoologic.bj skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip/avenger/winupdate/winupdate.exe Infected: Trojan.Win32.Crypt.e skipped
    C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip ZIP: infected - 6 skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-846.dll Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-869.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-875.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\81BCVP2L\OiUninstaller[1].exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\81BCVP2L\OiUninstaller[1].exe NSIS: infected - 1 skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\81BCVP2L\wallpap[1].exe Infected: Trojan-Clicker.Win32.Small.jf skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\M9A9MVSJ\new[1].htm Infected: Constructor.Perl.Msdds.b skipped
    C:\Program Files\Аdobe\scanregw.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\ssn6tuu.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\tfthot.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.f skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\winlogon.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\RECYCLER\S-1-5-21-224417437-2781512093-2853268408-1005\Dc2823\x3cqp0.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP18\A0002595.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP18\A0002720.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP19\A0002782.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP19\A0002908.exe Infected: Trojan-Downloader.Win32.PurityScan.bj skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP19\snapshot\MFEX-62.DAT Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004094.exe Infected: Trojan.Win32.Scapur.k skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004129.exe Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004130.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004130.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004130.exe CAB: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP23\A0004132.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP25\A0004188.exe Infected: Trojan.Win32.StartPage.ajj skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP26\A0004545.exe Infected: Trojan.Win32.Zapchast.bl skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005170.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005171.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005173.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005173.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005173.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005174.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005174.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005174.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.u skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe UPX: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe PE_Patch.UPX: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005184.exe Infected: Trojan.Win32.StartPage.ajj skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005185.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005312.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005332.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005333.dll Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP28\A0005334.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006541.exe Infected: Trojan-Downloader.Win32.Agent.ala skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006542.exe Infected: Trojan-Downloader.Win32.VB.nw skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006543.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.l skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006543.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006544.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006545.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.f skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006546.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006546.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006546.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006547.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006547.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006547.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0004 Infected: Trojan-Downloader.MSIL.Agent.a skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0010 Infected: Trojan.Win32.Zapchast.bl skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0011/data0006 Infected: Trojan-Dropper.Win32.VB.mz skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe/data0011 Infected: Trojan-Dropper.Win32.VB.mz skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006548.exe NSIS: infected - 4 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006549.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006814.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006814.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.av skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0006814.exe CAB: infected - 2 skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0007422.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP30\A0007590.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP31\A0009537.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP31\A0009538.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP31\A0009539.dll Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped
    C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP31\A0009540.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.f skipped

    Scan process completed.





    <HTML>
    <HEAD>
    <TITLE>BitDefender Online Scanner -Scan Report</TITLE>
    <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
    <meta name="generator" content="Namo WebEditor v5.0(Trial)">
    </HEAD>
    <BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >


    <table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
    <tr>
    <td width="458">
    <p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender
    Online Scanner</b></span></font></p>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>
    <tr>
    <td colspan="3" width="912">
    <p><font face="Arial"><span style="font-size:11pt;"><B>Scan report generated
    at: Sun, Jun 25, 2006 - 19:55:37</b></span></font></p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <p><font face="Arial"><span style="font-size:11pt;"><B>Scan
    path: </b></span><span style="font-size:10pt;">C:\;D:\;</span></font></p>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
    <tr>
    <td width="451" colspan="2" bgcolor="#CCCCCC">
    <p><font face="Arial" size="2"><B>Statistics</b></font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Time</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">00:45:37</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Files</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">338763</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Folders</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">3560</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Boot Sectors</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">3</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Archives</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">2587</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Packed Files</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">40896</font></p>
    </td>
    </tr>
    </table>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>



    <tr>
    <td width="458">
    <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
    <tr>
    <td width="451" colspan="2" bgcolor="#CCCCCC">
    <p><font face="Arial" size="2"><B>Results</b></font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Identified Viruses </font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">6</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Infected Files </font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">11</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Suspect Files </font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">0</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Warnings</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">0</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Disinfected</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">0</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Deleted Files</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">11</font></p>
    </td>
    </tr>
    </table>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
    <tr>
    <td width="451" colspan="2" bgcolor="#CCCCCC">
    <p><font face="Arial" size="2"><B>Engines Info</b></font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Virus Definitions</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">389435</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Engine build</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Scan plugins</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">13</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Archive plugins</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">39</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Unpack plugins</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">5</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">E-mail plugins</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">6</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">System plugins</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">1</font></p>
    </td>
    </tr>
    </table>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
    <tr>
    <td width="451" colspan="2" bgcolor="#CCCCCC">
    <p><font face="Arial" size="2"><B>Scan Settings</b></font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">First Action</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Disinfect</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Second Action</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Delete</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Heuristics</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Yes</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Enable Warnings</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Yes</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Scanned Extensions</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">*;</font></p>
    </td>
    </tr>

    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Exclude Extensions</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2"> </font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Scan Emails</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Yes</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Scan Archives</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Yes</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Scan Packed</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Yes</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Scan Files</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Yes</font></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">Scan Boot</font></p>
    </td>
    <td width="43%" align="right">
    <p><font face="Arial" size="2">Yes</font></p>
    </td>
    </tr>
    </table>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td colspan=2>  
    <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
    <tr>
    <td width="252" bgcolor="#CCCCCC">
    <p><font face="Arial" size="2"><B>Scanned File</b></font></p>
    </td>
    <td width="195" bgcolor="#CCCCCC" align="right">
    <p align="left"><b><font size="2" face="Arial"> Status</font></b></p>
    </td>
    </tr>
    <tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/FTFSC.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Trojan.Downloader.Qoologic.BC</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/FTFSC.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/FTFSC.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/PKOOCR.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Trojan.Downloader.Qoologic.BC</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/PKOOCR.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/PKOOCR.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/QPMVMWJ.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Trojan.Downloader.Qoologic.BC</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/QPMVMWJ.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/QPMVMWJ.EXE</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/UHDRN.DAT</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Trojan.Downloader.Qoologic.BC</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/UHDRN.DAT</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/UHDRN.DAT</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/VRNOSAU.DLL</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Trojan.Downloader.Qoologic.BJ</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/VRNOSAU.DLL</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/winupdate/winupdate.exe</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Backdoor.1053.A</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/winupdate/winupdate.exe</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip=>avenger/winupdate/winupdate.exe</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\avenger\backup-Mon 06.19.2006-14.39.46.65.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>BlackBox.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Java.Trojan.Exploit.Bytverify</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>BlackBox.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>BlackBox.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>VerifierBug.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Java.Trojan.Exploit.Bytverify.C</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>VerifierBug.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>VerifierBug.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>Dummy.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Java.Trojan.Exploit.Bytverify</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>Dummy.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>Dummy.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>Beyond.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Java.Trojan.Exploit.Bytverify.C</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>Beyond.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip=>Beyond.class</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-2ef0ec4d.zip</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Updated</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe=>(NSIS o)</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Infected with: Trojan.Downloader.Agent.AOE</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe=>(NSIS o)</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Disinfection failed</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe=>(NSIS o)</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Deleted</font></p>
    </td>
    </tr><tr>
    <td width="57%">
    <p><font face="Arial" size="2">C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP27\A0005176.exe</font></p>
    </td>
    <td width="43%" align="left">
    <p><font face="Arial" size="2">Update failed</font></p>
    </td>
    </tr>
    </table>
    </td>

    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    <tr>
    <td width="458">
    <p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
    </td>
    <td width="40%">
    <p> </p>
    </td>
    <td width="10%">
    <p> </p>
    </td>
    </tr>

    </table>
    <p> </p>

    </body>
    </html>
  • NuppiNuppi South Ostrobothnia (Finland)
    edited June 2006
    Hi Zathras ,

    Shaba, my friend is this week away, and he asked me to help you.

    Lets clean your system restore Turn it off

    http://support.f-secure.com/enu/home/virusproblem/howtoclean/cleansystemrestore.shtml

    Restart your computer

    Download ATF Cleaner by Atribune to your desktop -> http://www.atribune.org/ccount/click.php?id=1

    Run ATF Cleaner -> Check select all -> Press Empty selected

    Download eScan to your desktop -> http://www.spywareinfo.dk/download/mwav.exe
    Run the file mwav.exe and unzip it to its default location, C:\Kaspersky

    1. Updating the scanner (close the eScan window if open)
    -> Go to My Computer
    -> C:\
    -> Kaspersky
    -> Run the file kavupd.exe, it starts downloading updates
    -> When downloading is finished, go to C:\Downloads
    -> Copy all the files in the Downloads folder by pressing CTRL+A and then CTRL+C
    -> Then go back to the C:\Kaspersky folder and paste the files by pressing CTRL+V
    -> Answer Yes to all when it asks about replacing files
    -> Now the scanner has been updated

    2. Scanner settings
    -> Go to folder C:\Kaspersky and run the file mwavscan.com (or mwavscan.exe)
    -> The scanner window opens
    -> Select the same settings than in this picture -> http://koti.mbnet.fi/pattaya1/eScan6.jpg
    -> When ready, press the Scan Clean button
    -> Scanning for infections begins

    3. Posting the results
    -> When the scan has finished (scan may take a quite long time), you'll need to post the findings
    -> Copy all the text in this field -> http://koti.mbnet.fi/pattaya1/eScan10.jpg
    -> Click the field, press CTRL+A, CTRL+C
    -> Then open Notepad and paste the findings into a new document by pressing CTRL+V
    -> Save the document to your desktop
    -> Post the contents of that textfile to here

    Boot comp and turn your comps system restore on.

    Scan hijackthis, and send a fresh log and escans textfile
  • Zathras
    edited June 2006
    Here is my escan
    File C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-5c60a9bf.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-869.dll tagged as not-a-virus:AdWare.Win32.PurityScan.ak. No Action Taken.
    File C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-875.dll tagged as not-a-virus:AdWare.Win32.Suggestor.o. No Action Taken.
    File C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\W9KT0BCR\new[1].htm infected by "Constructor.Perl.Msdds.b" Virus. Action Taken: File Renamed.


    and here is my hjt:
    Logfile of HijackThis v1.99.1
    Scan saved at 10:32:56 PM, on 6/26/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    C:\program files\softwin\bitdefender9\bdnagent.exe
    C:\program files\softwin\bitdefender9\bdswitch.exe
    C:\Program Files\Softwin\BitDefender9\bdmcon.exe
    C:\Program Files\NetWaiting\netWaiting.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    C:\Program Files\TClock\TClock.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
    O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
  • NuppiNuppi South Ostrobothnia (Finland)
    edited June 2006
    Hi Zathras,

    Looks much better now.

    Scan kaspersky onlinescan and copy results here.
  • Zathras
    edited June 2006
    KASPERSKY ON-LINE SCANNER REPORT
    Wednesday, June 28, 2006 12:12:20 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.78.0
    Kaspersky Anti-Virus database last update: 28/06/2006
    Kaspersky Anti-Virus database records: 203292

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 34385
    Number of viruses found: 6
    Number of infected objects: 13
    Number of suspicious objects: 0
    Duration of the scan process: 00:22:30

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-13bb72fa.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-13bb72fa.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-13bb72fa.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-13bb72fa.zip ZIP: infected - 3 skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-5c60a9bf.zip.mwt/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-5c60a9bf.zip.mwt/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-5c60a9bf.zip.mwt/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-ad16e61-5c60a9bf.zip.mwt ZIP: infected - 3 skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-869.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-875.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\KVTHQXOH\new[1].htm Infected: Constructor.Perl.Msdds.b skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\W9KT0BCR\new[1].htm.mwt Infected: Constructor.Perl.Msdds.b skipped
    C:\Program Files\Аdobe\scanregw.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped

    Scan process completed.
  • NuppiNuppi South Ostrobothnia (Finland)
    edited June 2006
    Copy follow lines and run avenger as Shaba tell you


    Files to delete:
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cou nt.jar-ad16e61-13bb72fa.zip
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cou nt.jar-ad16e61-5c60a9bf.zip.mwt
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\KVTHQXOH\new[1].htm
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\W9KT0BCR\new[1].htm.mwt
    C:\Program Files\Аdobe\scanregw.exe


    You should update your Java so you don't get the same infection in the future: (Vundo spreads through a vulnerability in older java versions)

    1. Click Start-> Control panel and double-click Java icon (coffee cup)
    2. Move to Update tab and update Java by clicking "Update Now". After that do a restart.
    3. If you can't make automatic update, get new version manually from here -> http://www.java.com/en/download/manual.jsp
    4. After restart go back to your Java settings thru control panel (Start->control panel->java).
    5. Select Temporary Internet Files and click Delete Files.
    6. Make sure that all these three are checked:

    Downloaded Applets
    Downloaded Applications
    Other files

    7. Click ok in Delete Temporary Internet Files window (Attention: This removes all loaded applications and applets from cache)
    8. Click ok to close Java window.

    Send Avenger log and a fresh hijack log
  • Zathras
    edited June 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 11:13:56 PM, on 6/28/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    C:\Program Files\Softwin\BitDefender9\bdnagent.exe
    C:\Program Files\Softwin\BitDefender9\bdswitch.exe
    C:\Program Files\Softwin\BitDefender9\bdmcon.exe
    C:\Program Files\NetWaiting\netWaiting.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\TClock\TClock.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Lindsey\Desktop\pc security\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [ViewpointPhotosDeviceConnect] C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.6.0\FotomatDeviceConnect.exe
    O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
    O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)


    avenger log was lost because of reboot
  • NuppiNuppi South Ostrobothnia (Finland)
    edited June 2006
    Hi Zathras,

    It looks good now. Scan Kaspersky on line scan ones more and send result.
  • Zathras
    edited June 2006
    KASPERSKY ON-LINE SCANNER REPORT
    Thursday, June 29, 2006 11:13:53 AM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.78.0
    Kaspersky Anti-Virus database last update: 29/06/2006
    Kaspersky Anti-Virus database records: 203485

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 41881
    Number of viruses found: 10
    Number of infected objects: 17
    Number of suspicious objects: 0
    Duration of the scan process: 00:29:47

    Infected Object Name / Virus Name / Last Action
    C:\avenger\backup-Wed 06.28.2006-23.09.56.18.zip/avenger/new[1].htm.mwt Infected: Constructor.Perl.Msdds.b skipped
    C:\avenger\backup-Wed 06.28.2006-23.09.56.18.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74b2599d-2f73c1a8.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74b2599d-2f73c1a8.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74b2599d-2f73c1a8.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-74b2599d-2f73c1a8.zip ZIP: infected - 3 skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-7e09d0a6-2d6164ef.zip/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-7e09d0a6-2d6164ef.zip/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-7e09d0a6-2d6164ef.zip ZIP: infected - 2 skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv493.jar-1661bf12-6250a2bf.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv493.jar-1661bf12-6250a2bf.zip/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv493.jar-1661bf12-6250a2bf.zip/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv493.jar-1661bf12-6250a2bf.zip ZIP: infected - 3 skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-869.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
    C:\Documents and Settings\Lindsey\Desktop\pc security\backups\backup-20060619-121932-875.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped
    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\WRRPM71Y\new[1].htm Infected: Constructor.Perl.Msdds.b skipped
    C:\Program Files\Аdobe\scanregw.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped

    Scan process completed.
  • NuppiNuppi South Ostrobothnia (Finland)
    edited June 2006
    Yes, they didn't go away by avenger,

    Boot to safe mode and delete those files :


    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ >>>>count.jar-74b2599d-2f73c1a8.zip

    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ >>>>java.jar-7e09d0a6-2d6164ef.zip

    C:\Documents and Settings\Lindsey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ >>loaderadv493.jar-1661bf12-6250a2bf.zip

    C:\Documents and Settings\Lindsey\Local Settings\Temporary Internet Files\Content.IE5\WRRPM71Y\ >>new[1].htm

    C:\Program Files\Аdobe\ >>scanregw.exe

    Rest founded by kaspersky are in bacups off avenger and hijackthis.

    After deleting it your comp is clean :)
Sign In or Register to comment.