« previous next »
Pages: [1] 2

Author Topic: Virus/Worm from an Egreeting?  (Read 1108 times)

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« on: May 08, 2008, 10:15:42 PM »
Hi,

I posted another question before and this is regarding another issue i came across recently. Recently I have been receiving some egreetings from people I don't know with the headers stating things such as "you received a passion up greeting card!" and another email stating "you have received a secretletter!" when i open the email it has the sender and my name and email and it gives a link to the egreeting. It had the senders' IP addresses also. And yes, I opened the ecard http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/sad.gif\' class=\'bbc_emoticon\' alt=\':(\' />  Could this be a virus as after I did some search on the net I found that people can send viruses through ecards like this.

I am also experiancing things like curser flickering weirdly after clicking on something and just now got an error saying IE could not be read or something like that.

What should i do?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:28 AM, on 5/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as...abs/tgctlsr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1209346489625
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B9C9EAC-17F0-4D34-B01C-053A9AF6F861}: NameServer = 203.115.0.46 203.115.0.47
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 6673 bytes
« Last Edit: May 08, 2008, 10:30:35 PM by wormit »
Logged

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #1 on: May 09, 2008, 12:32:51 PM »
I ran a KASPERSKY scan:


-------------------------------------------------------------------------------
 KASPERSKY ONLINE SCANNER REPORT
 Friday, May 09, 2008 11:22:33 PM
 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
 Kaspersky Online Scanner version: 5.0.98.0
 Kaspersky Anti-Virus database last update:  9/05/2008
 Kaspersky Anti-Virus database records: 749055
-------------------------------------------------------------------------------

Scan Settings:
   Scan using the following antivirus database: extended
   Scan Archives: true
   Scan Mail Bases: true

Scan Target - My Computer:
   C:\
   D:\
   E:\
   F:\

Scan Statistics:
   Total number of scanned objects: 73801
   Number of viruses found: 9
   Number of infected objects: 37
   Number of suspicious objects: 0
   Duration of the scan process: 01:20:44

Infected Object Name / Virus Name / Last Action
C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector   Object is locked   skipped
C:\Documents and Settings\Acer\Cookies\index.dat   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\History\History.IE5\index.dat   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\History\History.IE5\MSHist012008050920080510\index.dat   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\Temp\fla30.tmp   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\Temp\Perflib_Perfdata_924.dat   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\Temp\~DF3D45.tmp   Object is locked   skipped
C:\Documents and Settings\Acer\Local Settings\Temporary Internet Files\Content.IE5\index.dat   Object is locked   skipped
C:\Documents and Settings\Acer\My Documents\Downloads\Paradise_Pet_Salon_v1.0_CRACKED[TE].zip/Paradise_Pet_Salon_v1.0_CRACKED[TE]/install.exe   Infected: not-virus:Hoax.Win32.Agent.p   skipped
C:\Documents and Settings\Acer\My Documents\Downloads\Paradise_Pet_Salon_v1.0_CRACKED[TE].zip   7-Zip: infected - 1   skipped
C:\Documents and Settings\Acer\NTUSER.DAT   Object is locked   skipped
C:\Documents and Settings\Acer\ntuser.dat.LOG   Object is locked   skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat   Object is locked   skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat   Object is locked   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat   Object is locked   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN/keygen.exe   Infected: Trojan.Win32.Inject.mt   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN/crack.exe   Infected: Trojan-Downloader.Win32.Agent.dlu   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN/serial.exe   Infected: Trojan-Dropper.Win32.Agent.cdc   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN/install.exe   Infected: Virus.Win32.Virut.ae   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN   RAR: infected - 4   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN   CryptZ: infected - 4   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN/keygen.exe   Infected: Trojan.Win32.Inject.mt   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN/crack.exe   Infected: Trojan-Downloader.Win32.Agent.dlu   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN/serial.exe   Infected: Trojan-Dropper.Win32.Agent.cdc   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN/install.exe   Infected: Virus.Win32.Virut.ae   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN   RAR: infected - 4   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN   CryptZ: infected - 4   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09400000\4FC98031.VBN   Infected: Worm.Win32.AutoRun.bsy   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540000\4FD7DC04.VBN   Infected: Trojan-Downloader.Win32.Tiny.fl   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540001\4FD7DC1E.VBN   Infected: Trojan-Downloader.Win32.Tiny.fl   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540002\4FD7DC24.VBN   Infected: Trojan-Downloader.Win32.Tiny.fl   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540003\4FD7DC29.VBN   Infected: Trojan-Downloader.Win32.Tiny.fl   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540004\4FD7DC47.VBN   Infected: Trojan-Downloader.Win32.Tiny.fl   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540005\4FD7DC4C.VBN   Infected: Trojan-Downloader.Win32.Tiny.fl   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A480000\4F5B0EA2.VBN   Infected: Worm.VBS.Solow.b   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN/keygen.exe   Infected: Trojan.Win32.Inject.mt   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN/crack.exe   Infected: Trojan-Downloader.Win32.Agent.dlu   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN/serial.exe   Infected: Trojan-Dropper.Win32.Agent.cdc   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN/install.exe   Infected: Virus.Win32.Virut.ae   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN   RAR: infected - 4   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN   CryptZ: infected - 4   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN/keygen.exe   Infected: Trojan.Win32.Inject.mt   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN/crack.exe   Infected: Trojan-Downloader.Win32.Agent.dlu   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN/serial.exe   Infected: Trojan-Dropper.Win32.Agent.cdc   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN/install.exe   Infected: Virus.Win32.Virut.ae   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN   RAR: infected - 4   skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN   CryptZ: infected - 4   skipped
C:\Documents and Settings\LocalService\Cookies\index.dat   Object is locked   skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat   Object is locked   skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG   Object is locked   skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat   Object is locked   skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat   Object is locked   skipped
C:\Documents and Settings\LocalService\NTUSER.DAT   Object is locked   skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG   Object is locked   skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat   Object is locked   skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG   Object is locked   skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT   Object is locked   skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log   Object is locked   skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log   Object is locked   skipped
C:\Program Files\DAP\History\Acer\_lasthist.dat   Object is locked   skipped
C:\Program Files\DAP\Log\DAP_REPORT.LOG   Object is locked   skipped
C:\Program Files\DAP\Offers\VA21_DAPSO.exe/WISE0009.BIN   Infected: not-a-virus:AdTool.Win32.MyWebSearch.bk   skipped
C:\Program Files\DAP\Offers\VA21_DAPSO.exe   WiseSFX: infected - 1   skipped
C:\Program Files\DAP\Offers\VA21_DAPSO.exe   WiseSFXDropper: infected - 1   skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0157NAV~.TMP   Object is locked   skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0868NAV~.TMP   Object is locked   skipped
C:\Program Files\Yahoo!\Messenger\logs\billing_Acer.log   Object is locked   skipped
C:\Program Files\Yahoo!\Messenger\logs\client_Acer.log   Object is locked   skipped
C:\Program Files\Yahoo!\Messenger\logs\network_Acer.log   Object is locked   skipped
C:\System Volume Information\MountPointManagerRemoteDatabase   Object is locked   skipped
C:\WINDOWS\Debug\PASSWD.LOG   Object is locked   skipped
C:\WINDOWS\SchedLgU.Txt   Object is locked   skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log   Object is locked   skipped
C:\WINDOWS\Sti_Trace.log   Object is locked   skipped
C:\WINDOWS\system32\CatRoot2\edb.log   Object is locked   skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb   Object is locked   skipped
C:\WINDOWS\system32\config\AppEvent.Evt   Object is locked   skipped
C:\WINDOWS\system32\config\default   Object is locked   skipped
C:\WINDOWS\system32\config\default.LOG   Object is locked   skipped
C:\WINDOWS\system32\config\SAM   Object is locked   skipped
C:\WINDOWS\system32\config\SAM.LOG   Object is locked   skipped
C:\WINDOWS\system32\config\SecEvent.Evt   Object is locked   skipped
C:\WINDOWS\system32\config\SECURITY   Object is locked   skipped
C:\WINDOWS\system32\config\SECURITY.LOG   Object is locked   skipped
C:\WINDOWS\system32\config\software   Object is locked   skipped
C:\WINDOWS\system32\config\software.LOG   Object is locked   skipped
C:\WINDOWS\system32\config\SysEvent.Evt   Object is locked   skipped
C:\WINDOWS\system32\config\system   Object is locked   skipped
C:\WINDOWS\system32\config\system.LOG   Object is locked   skipped
C:\WINDOWS\system32\drivers\atapi.sys   Object is locked   skipped
C:\WINDOWS\system32\h323log.txt   Object is locked   skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR   Object is locked   skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP   Object is locked   skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER   Object is locked   skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP   Object is locked   skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP   Object is locked   skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA   Object is locked   skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP   Object is locked   skipped
C:\WINDOWS\wiadebug.log   Object is locked   skipped
C:\WINDOWS\wiaservc.log   Object is locked   skipped
C:\WINDOWS\WindowsUpdate.log   Object is locked   skipped
D:\autorun.inf\lpt3.This folder was created by Flash_Disinfector   Object is locked   skipped
D:\System Volume Information\MountPointManagerRemoteDatabase   Object is locked   skipped

Scan process completed.
« Last Edit: May 09, 2008, 12:54:38 PM by wormit »
Logged

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #2 on: May 09, 2008, 10:47:26 PM »
Just realized that  I cannot run scans from my AV. It displays the error saying "could not start scan. Scan engine returned error 0x20000058". Can someone please help??
« Last Edit: May 09, 2008, 10:49:07 PM by wormit »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #3 on: May 10, 2008, 11:13:46 AM »
Empty the Quarantine section of Norton's
How old is your version of Symantec's?

You should delete this file
C:\Documents and Settings\Acer\My Documents\Downloads\Paradise_Pet_Salon_v1.0_CRACKED[TE].zip
and the next one
C:\Program Files\DAP\Offers\VA21_DAPSO.exe
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #4 on: May 10, 2008, 11:53:53 AM »
I tried to delete the Quarantined items but it failed. My AV versioncopyright is for 2005 (if that's what ur asking for)
I deleted C:\Documents and Settings\Acer\My Documents\Downloads\Paradise_Pet_Salon_v1.0_CRACKED[TE].zip
and C:\Program Files\DAP\Offers\VA21_DAPSO.exe

Still cant use the AV scan


HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:54 AM, on 5/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as...abs/tgctlsr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1209346489625
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B9C9EAC-17F0-4D34-B01C-053A9AF6F861}: NameServer = 203.115.0.46 203.115.0.47
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 7379 bytes


Doesnt the "F2 - REG:system.ini: Shell=" look suspicious in the HJT log?
« Last Edit: May 10, 2008, 11:55:56 AM by wormit »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #5 on: May 10, 2008, 11:57:07 AM »
Edit>>
Quote
Doesnt the "F2 - REG:system.ini: Shell=" look suspicious in the HJT log?
Yup, it does

Quote
Just realized that I cannot run scans from my AV. It displays the error saying "could not start scan. Scan engine returned error 0x20000058". Can someone please help??

Sorry, didn't see this
This can happen if the Winlogon key is corrupt
As indicated by Hijackthis, yours appears to be

Can you do the following, I just want to double check the value
=Open Notepad (START>>>RUN>>>type in notepad)
Hit OK
Copy the contents of the CODE box, not including the word "code"
Paste it to the empty Notepad file
In Notepad click FILE>>SAVE AS
Change the Save as Type to All Files.
Name the file as Export.bat

Save this file on the desktop
 
Code: [Select]
regedit /e export.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon"
export.txt

Double click on Export.bat, a text file should open
Copy>paste the whole contents back here please
« Last Edit: May 10, 2008, 11:58:15 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #6 on: May 10, 2008, 12:03:24 PM »
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]
"AutoRestartShell"=dword:00000001
"DefaultDomainName"="CSL-524C4D2B833"
"DefaultUserName"="Acer"
"LegalNoticeCaption"=""
"LegalNoticeText"=""
"PowerdownAfterShutdown"="0"
"ReportBootOk"="1"
"ShutdownWithoutLogon"="0"
"System"=""
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"SfcQuota"=dword:ffffffff
"allocatecdroms"="0"
"allocatedasd"="0"
"allocatefloppies"="0"
"cachedlogonscount"="10"
"forceunlocklogon"=dword:00000000
"passwordexpirywarning"=dword:0000000e
"scremoveoption"="0"
"AllowMultipleTSSessions"=dword:00000001
"UIHost"=hex(2):6c,00,6f,00,67,00,6f,00,6e,00,75,00,69,00,2e,00,65,00,78,00,65,\
  00,00,00
"LogonType"=dword:00000001
"Background"="0 0 0"
"DebugServerCommand"="no"
"SFCDisable"=dword:00000000
"WinStationsDisabled"="0"
"HibernationPreviouslyEnabled"=dword:00000001
"ShowLogonOptions"=dword:00000000
"AltDefaultUserName"="Acer"
"AltDefaultDomainName"="CSL-524C4D2B833"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
@="Wireless"
"ProcessGroupPolicy"="ProcessWIRELESSPolicy"
"DllName"=hex(2):67,00,70,00,74,00,65,00,78,00,74,00,2e,00,64,00,6c,00,6c,00,\
  00,00
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
@="Folder Redirection"
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"DllName"=hex(2):66,00,64,00,65,00,70,00,6c,00,6f,00,79,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"NoMachinePolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"NoGPOListChanges"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"GenerateGroupPolicy"="GenerateGroupPolicy"
"EventSources"=hex(7):28,00,46,00,6f,00,6c,00,64,00,65,00,72,00,20,00,52,00,65,\
  00,64,00,69,00,72,00,65,00,63,00,74,00,69,00,6f,00,6e,00,2c,00,41,00,70,00,\
  70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,29,00,00,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
@="Microsoft Disk Quota"
"NoMachinePolicy"=dword:00000000
"NoUserPolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"RequiresSuccessfulRegistry"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000000
"DllName"=hex(2):64,00,73,00,6b,00,71,00,75,00,6f,00,74,00,61,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"ProcessGroupPolicy"="ProcessGroupPolicy"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
@="QoS Packet Scheduler"
"ProcessGroupPolicy"="ProcessPSCHEDPolicy"
"DllName"=hex(2):67,00,70,00,74,00,65,00,78,00,74,00,2e,00,64,00,6c,00,6c,00,\
  00,00
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
@="Scripts"
"ProcessGroupPolicy"="ProcessScriptsGroupPolicy"
"ProcessGroupPolicyEx"="ProcessScriptsGroupPolicyEx"
"GenerateGroupPolicy"="GenerateScriptsGroupPolicy"
"DllName"=hex(2):67,00,70,00,74,00,65,00,78,00,74,00,2e,00,64,00,6c,00,6c,00,\
  00,00
"NoSlowLink"=dword:00000001
"NoGPOListChanges"=dword:00000001
"NotifyLinkTransition"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
@="Internet Explorer Zonemapping"
"DllName"=hex(2):69,00,65,00,64,00,6b,00,63,00,73,00,33,00,32,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap"
"NoGPOListChanges"=dword:00000001
"RequiresSucessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"ProcessGroupPolicy"="SceProcessSecurityPolicyGPO"
"GenerateGroupPolicy"="SceGenerateGroupPolicy"
"ExtensionRsopPlanningDebugLevel"=dword:00000001
"ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx"
"ExtensionDebugLevel"=dword:00000001
"DllName"=hex(2):73,00,63,00,65,00,63,00,6c,00,69,00,2e,00,64,00,6c,00,6c,00,\
  00,00
@="Security"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000001
"MaxNoGPOListChangesInterval"=dword:000003c0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"ProcessGroupPolicy"="ProcessGroupPolicy"
"DllName"=hex(2):69,00,65,00,64,00,6b,00,63,00,73,00,33,00,32,00,2e,00,64,00,\
  6c,00,6c,00,00,00
@="Internet Explorer Branding"
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000001
"NoMachinePolicy"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"ProcessGroupPolicy"="SceProcessEFSRecoveryGPO"
"DllName"=hex(2):73,00,63,00,65,00,63,00,6c,00,69,00,2e,00,64,00,6c,00,6c,00,\
  00,00
@="EFS recovery"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"RequiresSuccessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
@="Microsoft Offline Files"
"DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,\
  00,73,00,63,00,75,00,69,00,2e,00,64,00,6c,00,6c,00,00,00
"EnableAsynchronousProcessing"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000000
"NoMachinePolicy"=dword:00000000
"NoSlowLink"=dword:00000000
"NoUserPolicy"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"ProcessGroupPolicy"="ProcessGroupPolicy"
"RequiresSuccessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
@="Software Installation"
"DllName"=hex(2):61,00,70,00,70,00,6d,00,67,00,6d,00,74,00,73,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"NoBackgroundPolicy"=dword:00000000
"RequiresSucessfulRegistry"=dword:00000000
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"EventSources"=hex(7):28,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,\
  00,6f,00,6e,00,20,00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,00,6e,00,\
  74,00,2c,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,\
  00,29,00,00,00,28,00,4d,00,73,00,69,00,49,00,6e,00,73,00,74,00,61,00,6c,00,\
  6c,00,65,00,72,00,2c,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,\
  00,6f,00,6e,00,29,00,00,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
@="IP Security"
"ProcessGroupPolicy"="ProcessIPSECPolicy"
"DllName"=hex(2):67,00,70,00,74,00,65,00,78,00,74,00,2e,00,64,00,6c,00,6c,00,\
  00,00
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\!SASWinLogon]
"DllName"="C:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll"
"Logon"="SABWINLOLogon"
"Logoff"="SABWINLOLogoff"
"Startup"="SABWINLOStartup"
"Shutdown"="SABWINLOShutdown"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\NavLogon]
"Logoff"="NavLogoffEvent"
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"LoginDomain"="CSL-524C4D2B833"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #7 on: May 10, 2008, 12:10:37 PM »
Open Notepad (START>>>RUN>>>type in notepad)
Hit OK
Copy the contents of the CODE box, not including the word "code"
Paste it to the empty Notepad file
In Notepad click FILE>>SAVE AS
IMPORTANT>>>Change the Save as Type to All Files.
Name the file as fix.reg

Save this file on the desktop
Ensure to copy from REGEDIT4 and down in the code box

 
Code: [Select]
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]
"Shell"="Explorer.exe"

Close down all open browser windows
Double click on fix.reg and allow to add/merge to the registry at the prompt

Reboot the computer afterwards

Come back here and post a fresh hijackthis log
Also, let me know if Norton's will scan,
Note: Norton's is a bit outdated, would you like to try an alternate AV?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #8 on: May 10, 2008, 12:24:06 PM »
My AV scanner is working again! Guestolo ur a genious!  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> .
Do you think it is better to get anoother AV? If so what do u recommend?
And also, is my computer free of viruses/worms etc?


Here's my HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:22:23 AM, on 5/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as...abs/tgctlsr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1209346489625
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 7213 bytes
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #9 on: May 10, 2008, 12:44:18 PM »
I noticed you have installed SuperAntispyware
Did you update and run a scan?

If so, can you open SA, click on PREFERENCES>>STATISTICS/LOGS
Highlight the log and click on VIEW LOG

Copy>paste back here the whole contents

I would like to see you try a free AV I use
But we would have to ensure that Symantec's is removed, don't do it yet
But can you also do the following
Please supply an uninstall list from Hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #10 on: May 10, 2008, 12:49:02 PM »
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/10/2008 at 12:49 PM

Application Version : 4.0.1154

Core Rules Database Version : 3457
Trace Rules Database Version: 1449

Scan type       : Complete Scan
Total Scan Time : 00:29:29

Memory items scanned      : 456
Memory threats detected   : 0
Registry items scanned    : 4400
Registry threats detected : 0
File items scanned        : 12280
File threats detected     : 67

Adware.Tracking Cookie
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@realmedia[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@indextools[2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\acer@fitsl1209740400[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@adbrite[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@zedo[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@burstnet[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@tacoda[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@yadro[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@tradedoubler[2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@adrevolver[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@247realmedia[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@specificclick[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@tripod[2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\acer@revsci[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@nextag[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@cgi-bin[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@tribalfusion[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@insightexpressai[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@indexstats[2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@revenue[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@fastclick[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@kontera[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@eyewonder[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@doubleclick[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@adrevolver[3].txt
   C:\Documents and Settings\Acer\Cookies\acer@overture[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\acer@atwola[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@smt2[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@casalemedia[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@toplist[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@adserver[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\acer@atdmt[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\acer@questionmarket[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@pagead[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@bluestreak[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@adinterax[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@statcounter[2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\acer@mediaplex[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@adtech[1].txt
   C:\Documents and Settings\Acer\Cookies\acer@apmebf[1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@2o7[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@advertising[2].txt
   C:\Documents and Settings\Acer\Cookies\acer@serving-sys[2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][2].txt
   C:\Documents and Settings\Acer\Cookies\acer@hitbox[2].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt
   C:\Documents and Settings\Acer\Cookies\[email protected][1].txt

Uninstall list from HJT:

           
ACDSee 4.0
Adobe Acrobat 5.0
Adobe Flash Player ActiveX
Adobe Shockwave Player 11
AV301P Camera
Burger Shop
CleanUp!
Download Accelerator Plus (DAP)
Duke Nukem - Time To Kill
Duke Nukem Advance
eMusic - 50 Free MP3 offer
HijackThis 2.0.2
HP Image Zone Express
Intel® Graphics Media Accelerator Driver for Mobile
Kaspersky Online Scanner
LiveUpdate 2.6 (Symantec Corporation)
Microsoft Office XP Professional with FrontPage
Microsoft Visual C++ 2005 Redistributable
Nero Suite
PowerDVD
Prolink H8600 ADSL Modem
QuickTime
Realtek AC'97 Audio
Skypeâ„¢ 3.6
Soft Data Fax Modem with SmartCP
SPSS 15.0 for Windows Evaluation Version
SUPERAntiSpyware Free Edition
Symantec AntiVirus
The Sims 2
The Sims 2 Open For Business
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
WebEye
Winamp
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Media Format Runtime
Windows Media Player 10
WinRAR archiver
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #11 on: May 10, 2008, 01:09:52 PM »
You can go ahead and uninstall Kaspersky online scanner from Add and Remove programs

SuperAntispyware didn't find much but cookies, so that looks good

Here is a free AV I really like
After an update you may receive an ad, but click OK will close the Ad
Not a big deal

Download and save to your Desktop
Avira AntiVir
Do not install it yet

Download and Save to your desktop
Norton Removal Tool
From STEP 3
Don't use it yet, just leave it on desktop for now

You should Print the rest of these instructions, or save them to a text file on desktop for reference

Reopen SuperAntispyware>>Preferences,
Uncheck> Start on Windows startup
Close it, right click it's icon by the clock and select EXIT

I would now close down all open browser windows, and any other unnecessary running programs
Access your Add and Remove Programs and remove
Symantec AntiVirus
This can take some time, allow to finish
Reboot the computer afterwards

Back in Windows
Go back to Add and Remove Programs and remove
LiveUpdate 2.6 (Symantec Corporation)
Don't worry if you get a prompt it is needed, continue with removal

Afterwards: Run the Norton Removal tool from desktop
Follow the prompts
Reboot the computer afterwards

Back in Windows
Install Avira AntiVir from desktop
Ensure that you have it check for Updates
If it starts to run a scan, just exit out of it for now

After updating, reboot the computer, this ensures Windows sees it is fully up to date
Back in Windows
Time to run your first scan
Double click the Avira icon by the clock (the red Umbrella icon)
Click on Scan System now
The scan will begin

Quarantine or delete everything it finds
When the scan is finished, if it finds anything
Can you reboot the computer one last time

Then come back here and post one last hijackthis log
In addition
Open Avira again (Double click on the red Umbrella icon by the clock)
Click on REPORTS under Overview
Double click on the Scan report you just made
Then click on "Report File"
Post the contents of this report please
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #12 on: May 10, 2008, 01:16:56 PM »
I ran a Bitdefender scan also before and I think it found more than Superantispyware did. Just thought i'd post the results from that just in case


BitDefender Online Scanner - Real Time Virus ReportBitDefender Online
      Scanner - Real Time Virus Report  
      Generated at: Sat, May 10, 2008 - 17:22:25



         
      Scan Info  
            Scanned Files212991
            Infected Files60
       
         
      Virus Detected  
            Trojan.Downloader.Tiny.HX6
            Trojan.Agent.AGRT1
            Win32.Worm.Ahkheap.A1
            Trojan.ShipUp.A3
            Trojan.Shipup.A1
            Trojan.Virtumonde.IK4
            Trojan.Agent.LEW2
            Trojan.Wgapatch.A6
            Trojan.Downloader.LoadAdv.KP4
            DeepScan:Generic.Virtob.1.7644D6C14
            Packer.Malware.NSAnti.K2
            Worm.Hakaglan.A15
            Trojan.Dropper.RKD4
            Win32.Virtob.6.Gen4
            Trojan.Agent.AACH1
            Trojan.Generic.962452
       
         
       

       
      This summary of the scan process will be used by the BitDefender Antivirus
      Lab to create agregate statistics about virus activity around the world.
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #13 on: May 10, 2008, 01:23:18 PM »
That's not the full Scan report from BitDefender
Do you have the full report?
If so, post it

Please also do my last set of instructions
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #14 on: May 10, 2008, 01:27:07 PM »
BitDefender Online Scanner
 
 
 
Scan report generated at: Sat, May 10, 2008 - 15:55:10
 
 
 
 
 
Scan path: C:\Documents and Settings\Acer\Local Settings\Application Data\Microsoft\Messenger\AcerEmail Removed\Sharing Folders;C:\Documents and Settings\Acer\My Documents;C:\Documents and Settings\All Users\Documents;C:\;D:\;E:\;F:\;
 
 
 
 
 
 
 
Statistics
 
Time
 01:06:23
 
Files
 208084
 
Folders
 4371
 
Boot Sectors
 3
 
Archives
 1283
 
Packed Files
 7754
 
 
 
 
Results
 
Identified Viruses
 17
 
Infected Files
 60
 
Suspect Files
 0
 
Warnings
 0
 
Disinfected
 4
 
Deleted Files
 77
 
 
 
 
Engines Info
 
Virus Definitions
 1191041
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 16
 
Archive plugins
 42
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 5
 
 
 
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
 
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
 
 
 
  Scanned File
  Status
 
C:\Documents and Settings\Acer\My Documents\Downloads\32 bigfish games cracks+keygens.bone111.rar=>bigfish games cracks\dream.exe
 Infected with: Trojan.Generic.96245
 
C:\Documents and Settings\Acer\My Documents\Downloads\32 bigfish games cracks+keygens.bone111.rar=>bigfish games cracks\dream.exe
 Deleted
 
C:\Documents and Settings\Acer\My Documents\Downloads\32 bigfish games cracks+keygens.bone111.rar
 Update failed
 
C:\Documents and Settings\Acer\My Documents\Downloads\32 bigfish games cracks+keygens.bone111.rar=>bigfish games cracks\dream.exe
 Infected with: Trojan.Generic.96245
 
C:\Documents and Settings\Acer\My Documents\Downloads\32 bigfish games cracks+keygens.bone111.rar=>bigfish games cracks\dream.exe
 Deleted
 
C:\Documents and Settings\Acer\My Documents\Downloads\32 bigfish games cracks+keygens.bone111.rar
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440000\475F5648.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440000\475F5648.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440000\475F5648.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440001\475F564F.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440001\475F564F.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440001\475F564F.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440002\475F5657.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440002\475F5657.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440002\475F5657.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440003\475F565E.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440003\475F565E.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440003\475F565E.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440004\475F5666.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440004\475F5666.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440004\475F5666.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440005\475F566D.VBN=>(Quarantine-PE)
 Infected with: Trojan.Shipup.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440005\475F566D.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440006\475F5675.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440006\475F5675.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440006\475F5675.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440007\475F567C.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440007\475F567C.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440007\475F567C.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440008\475F5684.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440008\475F5684.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440008\475F5684.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440009\475F568B.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440009\475F568B.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440009\475F568B.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000A\475F5693.VBN=>(Quarantine-PE)
 Infected with: Trojan.ShipUp.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000A\475F5693.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000B\475F569A.VBN=>(Quarantine-PE)
 Infected with: Trojan.ShipUp.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000B\475F569A.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000B\475F569B.VBN=>(Quarantine-PE)
 Infected with: Trojan.ShipUp.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000B\475F569B.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000C\475F56A2.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000C\475F56A2.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000C\475F56A2.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000D\475F56AA.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000D\475F56AA.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000D\475F56AA.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000E\475F56B1.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000E\475F56B1.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000E\475F56B1.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000F\475F56B8.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000F\475F56B8.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0444000F\475F56B8.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440010\475F56C0.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440010\475F56C0.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440010\475F56C0.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440011\475F56C7.VBN
 Infected with: Worm.Hakaglan.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440011\475F56C7.VBN
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440011\475F56C7.VBN
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440013\475F56D7.VBN=>(Quarantine-PE)
 Infected with: Trojan.Agent.LEW
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440013\475F56D7.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440013\475F56D8.VBN=>(Quarantine-PE)
 Infected with: Trojan.Agent.LEW
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440013\475F56D8.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440014\475F56DF.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>MicrosoftPowerPoint\Install.txt
 Infected with: Trojan.Agent.AACH
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440014\475F56DF.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>MicrosoftPowerPoint\Install.txt
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440014\475F56DF.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>MicrosoftPowerPoint\Install.txt
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440014\475F56DF.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440014\475F56DF.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>MicrosoftPowerPoint\pathlist.txt
 Infected with: Win32.Worm.Ahkheap.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440014\475F56DF.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>MicrosoftPowerPoint\pathlist.txt
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04440014\475F56DF.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Infected with: Trojan.Downloader.LoadAdv.KP
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Infected with: Trojan.Virtumonde.IK
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Infected with: Trojan.Dropper.RKD
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: Win32.Virtob.6.Gen
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfected
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: DeepScan:Generic.Virtob.1.7644D6C1
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Infected with: Trojan.Downloader.LoadAdv.KP
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Infected with: Trojan.Virtumonde.IK
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Infected with: Trojan.Dropper.RKD
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: Win32.Virtob.6.Gen
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfected
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: DeepScan:Generic.Virtob.1.7644D6C1
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05740001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09400000\4FC98031.VBN=>(Quarantine-PE)
 Infected with: Packer.Malware.NSAnti.K
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09400000\4FC98031.VBN=>(Quarantine-PE)
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09400000\4FC98031.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09400000\4FC98032.VBN=>(Quarantine-PE)
 Infected with: Packer.Malware.NSAnti.K
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09400000\4FC98032.VBN=>(Quarantine-PE)
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09400000\4FC98032.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540000\4FD7DC04.VBN=>(Quarantine-PE)
 Infected with: Trojan.Downloader.Tiny.HX
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540000\4FD7DC04.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540001\4FD7DC1E.VBN=>(Quarantine-PE)
 Infected with: Trojan.Downloader.Tiny.HX
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540001\4FD7DC1E.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540002\4FD7DC24.VBN=>(Quarantine-PE)
 Infected with: Trojan.Downloader.Tiny.HX
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540002\4FD7DC24.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540003\4FD7DC29.VBN=>(Quarantine-PE)
 Infected with: Trojan.Downloader.Tiny.HX
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540003\4FD7DC29.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540004\4FD7DC47.VBN=>(Quarantine-PE)
 Infected with: Trojan.Downloader.Tiny.HX
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540004\4FD7DC47.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540005\4FD7DC4C.VBN=>(Quarantine-PE)
 Infected with: Trojan.Downloader.Tiny.HX
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09540005\4FD7DC4C.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180000\4A1B62ED.VBN=>(Quarantine-PE)
 Infected with: Trojan.Wgapatch.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180000\4A1B62ED.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180001\4A1B6473.VBN=>(Quarantine-PE)
 Infected with: Trojan.Wgapatch.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180001\4A1B6473.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180002\4A1B6C95.VBN=>(Quarantine-PE)
 Infected with: Trojan.Wgapatch.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180002\4A1B6C95.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180003\4A1B6CB0.VBN=>(Quarantine-PE)
 Infected with: Trojan.Wgapatch.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A180003\4A1B6CB0.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D700000\4D7ECC49.VBN=>(Quarantine-PE)
 Infected with: Trojan.Agent.AGRT
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D700000\4D7ECC49.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D700001\4D7ECD4E.VBN=>(Quarantine-PE)
 Infected with: Trojan.Wgapatch.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D700001\4D7ECD4E.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D700001\4D7ECD4F.VBN=>(Quarantine-PE)
 Infected with: Trojan.Wgapatch.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0D700001\4D7ECD4F.VBN=>(Quarantine-PE)
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Infected with: Trojan.Downloader.LoadAdv.KP
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Infected with: Trojan.Virtumonde.IK
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Infected with: Trojan.Dropper.RKD
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: Win32.Virtob.6.Gen
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfected
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: DeepScan:Generic.Virtob.1.7644D6C1
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00000.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Infected with: Trojan.Downloader.LoadAdv.KP
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>keygen.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Infected with: Trojan.Virtumonde.IK
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>crack.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Infected with: Trojan.Dropper.RKD
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>serial.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: Win32.Virtob.6.Gen
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfected
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Infected with: DeepScan:Generic.Virtob.1.7644D6C1
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)=>install.exe
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DF00001.VBN=>(Quarantine-PE)=>(RAR Sfx o)
 Update failed
« Last Edit: May 10, 2008, 01:35:24 PM by wormit »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #15 on: May 10, 2008, 01:47:17 PM »
Run my instructions in post #12

Post the logs please
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #16 on: May 10, 2008, 03:02:21 PM »
HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:01:50 AM, on 5/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as...abs/tgctlsr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1209346489625
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

--
End of file - 6059 bytes


AVIRA report:


Avira AntiVir Personal
Report file date: Sunday, May 11, 2008  03:16

Scanning for 1258665 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    CSL-524C4D2B833

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes    4/9/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes   3/18/2008 03:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes    2/7/2008 02:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes   2/28/2008 02:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes   2/21/2008 02:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes   7/18/2007 04:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes    3/7/2008 07:08:58
ANTIVIR2.VDF  : 7.0.4.0       1554432 Bytes    5/5/2008 19:10:12
ANTIVIR3.VDF  : 7.0.4.23        99840 Bytes    5/9/2008 19:10:15
Engineversion : 8.1.0.42  
AEVDF.DLL     : 8.1.0.5        102772 Bytes   2/25/2008 03:58:21
AESCRIPT.DLL  : 8.1.0.31       262522 Bytes   5/10/2008 19:10:54
AESCN.DLL     : 8.1.0.16       119156 Bytes   5/10/2008 19:10:51
AERDL.DLL     : 8.1.0.20       418165 Bytes   5/10/2008 19:10:48
AEPACK.DLL    : 8.1.1.4        364918 Bytes   5/10/2008 19:10:44
AEOFFICE.DLL  : 8.1.0.18       192890 Bytes   5/10/2008 19:10:39
AEHEUR.DLL    : 8.1.0.26      1237366 Bytes   5/10/2008 19:10:36
AEHELP.DLL    : 8.1.0.14       115063 Bytes   5/10/2008 19:10:26
AEGEN.DLL     : 8.1.0.20       299380 Bytes   5/10/2008 19:10:24
AEEMU.DLL     : 8.1.0.6        430451 Bytes   5/10/2008 19:10:21
AECORE.DLL    : 8.1.0.28       168310 Bytes   5/10/2008 19:10:18
AVWINLL.DLL   : 1.0.0.7         14593 Bytes   1/23/2008 11:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes   2/18/2008 04:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes   4/16/2007 07:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes   1/23/2008 11:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes   2/12/2008 02:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes   2/28/2008 02:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes   1/22/2008 11:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes   1/23/2008 11:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes   1/25/2008 06:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes   3/10/2008 08:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes    3/6/2008 06:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: Sunday, May 11, 2008  03:16

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'WINWORD.EXE' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'skypePM.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'YAHOOM~1.EXE' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'DAP.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
34 processes with 34 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'D:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '25' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\atapi.sys
      [WARNING]   The file could not be opened!
Begin scan in 'D:\' <New Volume>


End of the scan: Sunday, May 11, 2008  03:56
Used time: 39:53 min

The scan has been done completely.

   3981 Scanning directories
 253269 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 253269 Files not concerned
   1105 Archives were scanned
      2 Warnings
      0 Notes
« Last Edit: May 10, 2008, 03:03:12 PM by wormit »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #17 on: May 10, 2008, 03:20:19 PM »
Looks good, how's everything running?

Look through Avira's options, you can schedule a weekly scan if you like
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline wormit

  • Full Member
  • ***
  • Posts: 132
  • Karma: +0/-0
    • View Profile
Virus/Worm from an Egreeting?
« Reply #18 on: May 10, 2008, 03:34:38 PM »
Just wondering..do I need to be concerned about the 2 items that AVIRA couldnt open?
Quote
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\atapi.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <New Volume>

Other than that everything seems to be running smoothly. Thanks for ur help again Guestolo! http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
« Last Edit: May 10, 2008, 03:39:16 PM by wormit »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus/Worm from an Egreeting?
« Reply #19 on: May 10, 2008, 03:45:58 PM »
Nothing to worry about

I suggest that you add SpywareBlaster to your protection software
SpywareBlaster  by JavaCool  
    *Will block bad ActiveX Controls
    *Block Malevolent cookies in Internet Explorer and Firefox
    *Restrict actions of potentially dangerous sites in Internet Explorer
After installation, Check for updates
After updating, select "Protection Status" on the Left
Then select "Enable all Protection"
"Check for updates every couple of weeks"
after every update just simply click the "enable protection on all unprotected items"
or again, click on Protection Startus>>enable all protection

Take a look at miekiemoes site with other ideas on How to prevent Malware:

I hope that helps  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
« Last Edit: May 10, 2008, 03:46:15 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Pages: [1] 2
« previous next »