Help... My email is gone :(
Anc96
New
One minute my email folders were there, then I closed my email, reopened it, and they were gone.
Found them in my recycling bin, looking odd (not a OE icon) and not able to restore them.
After running the scans, they now have an OE icon, but still can't restore them. Some info in them is pretty important. I'd love to get them back.
Requested Reports looking pretty messy:
HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:43:25 PM, on 4/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\DOCUME~1\IAmHere\LOCALS~1\Temp\clclean.0001
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\Macromed\SHOCKW~1\SWHELP~2.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [VF0060 STISvc] RunDLL32.exe V0060Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\RunOnce: [Shockwave Updater] "C:\WINDOWS\system32\Macromed\SHOCKW~1\SWHELP~2.EXE" -Update -1020023 -IEXPLORE.EXE7.0
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Yahoo! Search - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/shared/FunGamesLoader.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.connect.com/XSL/mb_us/html/activexplayer/SMALStreaming.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/22.13/uploader2.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - https://www.webiqonline.com/WebIQ/bin/WebIQ.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1189206485312
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.disneyphotopass.com/software/ImageUploader4.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\Dell Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
--
End of file - 12901 bytes
ActiveScan:
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-04-10 20:40:03
PROTECTIONS: 1
MALWARE: 19
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
AVG 7.5.519 7.5.519 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.doubleclick.net/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.atdmt.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Cookies\iamhere@com[2].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.statcounter.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.burstnet.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.burstnet.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.burstnet.com/]
00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[[URL="http://www.burstbeacon.com/]"]www.burstbeacon.com/][/URL]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169752 application/need2find HackTools No 0 Yes No c:\program files\need2find
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.realmedia.com/]
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.searchportal.information.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Local Settings\Temp\Cookies\iamhere@target[2].txt
00233301 Hacktool/Yahoopsw.D HackTools No 0 Yes No C:\Program Files\Yahoo Message Archive Decoder\yahoopwd.exe
00233301 Hacktool/Yahoopsw.D HackTools No 0 No No C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe[yahoopwd.exe]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.atwola.com/]
00262025 Cookie/ErrorSafe TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.errorsafe.com/]
00262025 Cookie/ErrorSafe TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.errorsafe.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
02035706 Adware/Comet Adware No 0 Yes No C:\Documents and Settings\IAmHere\Local Settings\Temp\SSSInstaller.dll
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
108742 MEDIUM MS06-006
;===================================================================================================================================================================================
Kaspersky:
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 10, 2008 10:28:09 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/04/2008
Kaspersky Anti-Virus database records: 696523
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
Scan Statistics:
Total number of scanned objects: 104889
Number of viruses found: 4
Number of infected objects: 6
Number of suspicious objects: 35
Duration of the scan process: 01:24:37
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Sun\Java\Deployment\cache\6.0\3\6edc3c83-7d23badf Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-4-10-2008( 19-21-13 ).LOG Object is locked skipped
C:\Documents and Settings\IAmHere\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temp\clclean.0001.dir.0003\~efe2.tmp Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temp\SSSInstaller.dll Infected: not-a-virus:AdWare.Win32.Comet.bl skipped
C:\Documents and Settings\IAmHere\Local Settings\Temp\~DF177E.tmp Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\IAmHere\ntuser.dat Object is locked skipped
C:\Documents and Settings\IAmHere\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Panda Security\ActiveScan 2.0\ee366d2b2e4ede8287de879e85a0dcc2PSK_NAMES Object is locked skipped
C:\Program Files\Panda Security\ActiveScan 2.0\ee366d2b2e4ede8287de879e85a0dcc2PSK_NAMES2 Object is locked skipped
C:\Program Files\Windows Plus\progyrt.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped
C:\Program Files\Yahoo Message Archive Decoder\yahoopwd.exe Infected: not-a-virus:PSWTool.Win32.Yahoo.c skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe/stream/data0012 Infected: not-a-virus:PSWTool.Win32.Yahoo.c skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe/stream Infected: not-a-virus:PSWTool.Win32.Yahoo.c skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe NSIS: infected - 2 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP701\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B2C688D0-025B-4CFA-B6B1-CBDC9CD78FE5}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{5EFFB607-C06E-4A8E-B184-573AE18F9996}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
TIA for any help that you guys could give me.
Anc96
Found them in my recycling bin, looking odd (not a OE icon) and not able to restore them.
After running the scans, they now have an OE icon, but still can't restore them. Some info in them is pretty important. I'd love to get them back.
Requested Reports looking pretty messy:
HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:43:25 PM, on 4/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\DOCUME~1\IAmHere\LOCALS~1\Temp\clclean.0001
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\Macromed\SHOCKW~1\SWHELP~2.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [VF0060 STISvc] RunDLL32.exe V0060Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\RunOnce: [Shockwave Updater] "C:\WINDOWS\system32\Macromed\SHOCKW~1\SWHELP~2.EXE" -Update -1020023 -IEXPLORE.EXE7.0
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Yahoo! Search - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - [URL]file:///C:\Program[/URL] Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/shared/FunGamesLoader.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.connect.com/XSL/mb_us/html/activexplayer/SMALStreaming.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/22.13/uploader2.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - https://www.webiqonline.com/WebIQ/bin/WebIQ.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1189206485312
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.disneyphotopass.com/software/ImageUploader4.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\Dell Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
--
End of file - 12901 bytes
ActiveScan:
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-04-10 20:40:03
PROTECTIONS: 1
MALWARE: 19
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
AVG 7.5.519 7.5.519 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.trafficmp.com/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.doubleclick.net/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.atdmt.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Cookies\iamhere@com[2].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.statcounter.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.ad.yieldmanager.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.burstnet.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.burstnet.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.burstnet.com/]
00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[[URL="http://www.burstbeacon.com/]"]www.burstbeacon.com/][/URL]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.advertising.com/]
00169752 application/need2find HackTools No 0 Yes No c:\program files\need2find
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.realmedia.com/]
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.searchportal.information.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Local Settings\Temp\Cookies\iamhere@target[2].txt
00233301 Hacktool/Yahoopsw.D HackTools No 0 Yes No C:\Program Files\Yahoo Message Archive Decoder\yahoopwd.exe
00233301 Hacktool/Yahoopsw.D HackTools No 0 No No C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe[yahoopwd.exe]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.atwola.com/]
00262025 Cookie/ErrorSafe TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.errorsafe.com/]
00262025 Cookie/ErrorSafe TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.errorsafe.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296583 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.stats.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
00296584 Cookie/DriveCleaner TrackingCookie No 0 Yes No C:\Documents and Settings\IAmHere\Application Data\Mozilla\Firefox\Profiles\3cfwxnh9.default\cookies.txt[.drivecleaner.com/]
02035706 Adware/Comet Adware No 0 Yes No C:\Documents and Settings\IAmHere\Local Settings\Temp\SSSInstaller.dll
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
108742 MEDIUM MS06-006
;===================================================================================================================================================================================
Kaspersky:
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 10, 2008 10:28:09 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/04/2008
Kaspersky Anti-Virus database records: 696523
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
Scan Statistics:
Total number of scanned objects: 104889
Number of viruses found: 4
Number of infected objects: 6
Number of suspicious objects: 35
Duration of the scan process: 01:24:37
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\Sun\Java\Deployment\cache\6.0\3\6edc3c83-7d23badf Object is locked skipped
C:\Documents and Settings\IAmHere\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-4-10-2008( 19-21-13 ).LOG Object is locked skipped
C:\Documents and Settings\IAmHere\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temp\clclean.0001.dir.0003\~efe2.tmp Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temp\SSSInstaller.dll Infected: not-a-virus:AdWare.Win32.Comet.bl skipped
C:\Documents and Settings\IAmHere\Local Settings\Temp\~DF177E.tmp Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\IAmHere\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\IAmHere\ntuser.dat Object is locked skipped
C:\Documents and Settings\IAmHere\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Panda Security\ActiveScan 2.0\ee366d2b2e4ede8287de879e85a0dcc2PSK_NAMES Object is locked skipped
C:\Program Files\Panda Security\ActiveScan 2.0\ee366d2b2e4ede8287de879e85a0dcc2PSK_NAMES2 Object is locked skipped
C:\Program Files\Windows Plus\progyrt.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped
C:\Program Files\Yahoo Message Archive Decoder\yahoopwd.exe Infected: not-a-virus:PSWTool.Win32.Yahoo.c skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc122.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc176.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc286.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc344.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe/stream/data0012 Infected: not-a-virus:PSWTool.Win32.Yahoo.c skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe/stream Infected: not-a-virus:PSWTool.Win32.Yahoo.c skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc377.exe NSIS: infected - 2 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc401.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc51.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Fri, 10 Mar 2006 17:34:01 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You/[From eBay <endofitem@ebay.com>][Date Sun, 19 Mar 2006 18:39:09 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak/[From "Beebea" <abbycat@ptd.net>][Date Sat, 22 Jul 2006 15:51:53 -0400]/You Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\RECYCLER\S-1-5-21-601271039-861509660-4139523951-1005\Dc8.bak Mail MS Outlook 5: suspicious - 4 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP701\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B2C688D0-025B-4CFA-B6B1-CBDC9CD78FE5}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{5EFFB607-C06E-4A8E-B184-573AE18F9996}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
TIA for any help that you guys could give me.
Anc96
0
Comments
No infection there, and what you describe does not really sound like the actions of infection. If the file(s) you found are .dbx or .pst files then you may be looking at an archive action gone astray there. Comodo allows you to monitor things you would not normally view, and make choices on those as well, so if your OE was archiving, something similar to a Comodo function may have changed things. A guess, but something to start from.
Why not post a request on this in the Icrontic Operating Systems forum for recovering stored OE files.
I will post this in the forum you suggested. I'm glad to know there is no infection.
Anc96
This topic is now closed. If you wish it reopened, please send a Private Message to Trogan with a link to your thread.
If you are not the user who started this thread, you must start your own Thread instead