Trojans and Worms - yuk yuk

I created this thread in the Viruses / Trojans / Spyware conference, see URL below:

http://discussions.virtualdr.com/sho...62#post1142862

As you can see I ran the Kaspersky online Scan, which does not have autoclean but I was able to save the file in htm format. I have not run two other online scanners or Trojan Scanner because Han suggested that I go ahead and create a HJT log, which is posted below. I tried twice to run Trojan Scanner and got an error both times.

Quote:

---

The only one that I'm not sure about is ActiveScan\qrvkrn.ini ... submit that ini file here..

http://virusscan.jotti.org/

---

Han, per your request, I did a search for qrvkm.ini, but there is no ini file with this name on my computer.

Hopefully, Han is correct that this is a reasonably easy cleanup process. I deleted temporary internet files in IE and in Java. Does this also need to be done in FireFox? Then I ran the HJT log below.

Thanks for your help.

Linda

_________________

Logfile of HijackThis v1.99.1
Scan saved at 2:53:20 PM, on 4/1/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\WINNT\System32\CTsvcCDA.EXE
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
D:\Programs\Panda Platinum 7 - 2007\Firewall\PavFires.exe
D:\Programs\Panda Platinum 7 - 2007\pavsrv50.exe
D:\Programs\Panda Platinum 7 - 2007\AVENGINE.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINNT\system32\devldr32.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
D:\programs\qttask.exe
C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe
D:\Programs\Nero InCD Packet-Writing\InCD.exe
C:\Program Files\Creative\SBLive2k\Creative Diagnostics 2.0\DIAGENT.EXE
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\Programs\Panda Platinum 7 - 2007\APVXDWIN.EXE
C:\Program Files\Firetrust\Benign\B9.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
D:\Programs\Adobe\Distillr\acrotray.exe
D:\Programs\SnagIt 8.2\SnagIt32.exe
D:\Programs\SpywareGuard 2.2\SpywareGuard\sgmain.exe
D:\Programs\SnagIt 8.2\TSCHelp.exe
D:\Programs\SnagIt 8.2\SnagPriv.exe
D:\Programs\SpywareGuard 2.2\SpywareGuard\sgbhp.exe
C:\WINNT\system32\WISPTIS.EXE
C:\Program Files\Outlook Express\msimn.exe
D:\Programs\FireFox 1.5.0.2\firefox.exe
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Programs\TrojanHunter 4.6\TrojanHunter 4.6\THGuard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Programs\Microsoft Office 2003\OFFICE11\WINWORD.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.salon.com/
O1 - Hosts: 127.98.9.2 mail.ntpcug.org.b9
O1 - Hosts: 127.98.9.1 postoffice.swbell.net.b9
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Programs\SnagIt 8.2\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - D:\Programs\Pop-Up Stopper Companion\CCHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Programs\SpywareGuard 2.2\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programs\SPYBOT~1.1\SPYBOT~1.1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Desktop Search Capture - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar7.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programs\Adobe\Acrobat\AcroIEFavClient.dll
O2 - BHO: ieCom Class - {C6CEAC32-D45C-11D4-94AF-0050BABD5FD6} - D:\Programs\URL Organizer\UrlOrgIE.dll
O3 - Toolbar: Pop-Up Stopper &Companion - {8F05B1A8-9D77-4B8F-AF54-6B2202066F95} - D:\Programs\Pop-Up Stopper Companion\popupus.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programs\Adobe\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar7.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Programs\SnagIt 8.2\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [AtiPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\programs\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MailWasher] D:\Programs\MailWasher Pro\MailWasher Pro\MailWasher.exe
O4 - HKLM\..\Run: [InCD] D:\Programs\Nero InCD Packet-Writing\InCD.exe
O4 - HKLM\..\Run: [DIAGENT] C:\Program Files\Creative\SBLive2k\Creative Diagnostics 2.0\DIAGENT.EXE startup
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive2k\Program\AHQInit.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SCANINICIO] "D:\Programs\Panda Platinum 7 - 2007\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "D:\Programs\Panda Platinum 7 - 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [THGuard] "D:\Programs\TrojanHunter 4.6\TrojanHunter 4.6\THGuard.exe"
O4 - HKCU\..\Run: [b9] C:\Program Files\Firetrust\Benign\B9.exe /minimize
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: MailWasherPro.lnk = D:\Programs\MailWasher Pro\MailWasher Pro\MailWasher.exe
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = D:\Programs\Microsoft Office 2003\OFFICE11\ONENOTEM.EXE
O4 - Startup: SpywareGuard.lnk = D:\Programs\SpywareGuard 2.2\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Programs\Adobe\Distillr\acrotray.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = D:\Programs\Microsoft Office 2003\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: NTI Ninja.lnk = D:\Programs\NTI Ninja - USB partitioning encryption\Open.exe
O4 - Global Startup: SnagIt 8.lnk = D:\Programs\SnagIt 8.2\SnagIt32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Programs\OfficeXP\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Acronis Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - D:\Programs\ACRONI~1.0\ACRONI~1\Blocker.dll (file missing)
O9 - Extra 'Tools' menuitem: Acronis Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - D:\Programs\ACRONI~1.0\ACRONI~1\Blocker.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programs\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: cpcScanner - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.com/down/release/instub.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {0FF3E97F-433D-11D2-B31A-00A0C9B135DB} (CoDetectDigitalRiver Class) - http://ebot.digitalriver.com/v2.0-do...ard3.0.4.3.cab
O16 - DPF: {13991839-0420-11D5-BDA3-00A0C982BA51} (PDAnalyzeCtrl Class) - http://www.raxco.com/analyze/PDWeb.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/de.../GoogleNav.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1123599823452
O16 - DPF: {88E48871-88E6-4480-9921-F1EC4EB9AB74} (FileReadCtrl Class) - http://www.raxco.com/fileaccesstimer/WebTimedRead.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://msdn.demoservers.com/msrdp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://msevents.webex.com/client/la...ex/ieatgpc.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{25BC6CAC-69EC-457A-BA35-E4E1A902C98A}: NameServer = 151.164.1.8 206.13.28.12
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.EXE
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - D:\Programs\Panda Platinum 7 - 2007\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - D:\Programs\Panda Platinum 7 - 2007\pavsrv50.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe

Did you place quicktime here;
D:\programs\qttask.exe

==

1. Download this file :

http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/combofix.exe

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Chrunchie,

I probably did d/l QT because some website or program required it.

Here is the ComboFix log that I just ran per instructions.

Linda

________________


"Administrator" - Sun 04/01/2007 16:29:50 Service Pack 4
ComboFix 07-03-27.4.2 - Running from: "D:\Programs\TechSupport Forum - Chrunchie VDR"


((((((((((((((((((((((((((((((( Files Created from 2007-03-01 to 2007-04-01 ))))))))))))))))))))))))))))))))))


2007-04-01 12:04
d-------- C:\HJT
2007-03-29 00:40 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_72c.dat
2007-03-29 00:39 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_350.dat
2007-03-09 21:15 336 --a------ C:\Program Files\temp995.bat
2007-03-09 17:12
d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\pdf995
2007-03-09 17:04 51,716 --a------ C:\WINNT\SYSTEM32\pdf995mon.dll
2007-03-09 17:04 122,880 --a------ C:\WINNT\SYSTEM32\pdfmona.dll
2007-03-09 17:04
d-------- C:\Program Files\pdf995
2007-03-09 17:04
d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\pdf995
2007-03-09 17:03
d-------- C:\pdf995
2007-03-09 13:37 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_354.dat
2007-03-09 13:16
d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
2007-03-08 14:24
d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Viewpoint


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-03-09 11:44 -------- d--h----- C:\Program Files\installshield installation information
2007-02-26 17:01 16384 --a----t- C:\WINNT\SYSTEM32\perflib_perfdata_6f4.dat
2007-02-10 18:09 -------- d-------- C:\Program Files\google
2007-01-21 21:30 16384 --a----t- C:\WINNT\SYSTEM32\perflib_perfdata_70c.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"b9"="C:\\Program Files\\Firetrust\\Benign\\B9.exe /minimize"
"ctfmon.exe"="ctfmon.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"TCASUTIEXE"="TCAUDIAG -off"
"MULTIMEDIA KEYBOARD"="C:\\Program Files\\Netropa\\Multimedia Keyboard\\MMKeybd.exe"
"UpdReg"="C:\\WINNT\\Updreg.exe"
"AtiPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"QuickTime Task"="\"D:\\programs\\qttask.exe\" -atboottime"
"NeroCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"MailWasher"="D:\\Programs\\MailWasher Pro\\MailWasher Pro\\MailWasher.exe"
"InCD"="D:\\Programs\\Nero InCD Packet-Writing\\InCD.exe"
"DIAGENT"="C:\\Program Files\\Creative\\SBLive2k\\Creative Diagnostics 2.0\\DIAGENT.EXE startup"
"CreateCD50"="\"C:\\Program Files\\Common Files\\Adaptec Shared\\CreateCD\\CreateCD50.exe\" -r"
"AHQInit"="C:\\Program Files\\Creative\\SBLive2k\\Program\\AHQInit.exe"
"AdaptecDirectCD"="\"C:\\Program Files\\Adaptec\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Mell Reg Reminder"=""
"SCANINICIO"="\"D:\\Programs\\Panda Platinum 7 - 2007\\Inicio.exe\""
"APVXDWIN"="\"D:\\Programs\\Panda Platinum 7 - 2007\\APVXDWIN.EXE\" /s"
"Ninja"=""
"THGuard"="\"D:\\Programs\\TrojanHunter 4.6\\TrojanHunter 4.6\\THGuard.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{81559C35-8464-49F7-BB0E-07A383BEF910}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
rpcss REG_MULTI_SZ RpcSs\0\0
wugroup REG_MULTI_SZ wuauserv\0\0
BITSgroup REG_MULTI_SZ BITS\0\0

hklm\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
WmdmPmSN



********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: Sun 2007-04-01 16:35:30

When I first started researching this problem, I thought that I would uninstall the most recent programs that I had downloaded. One of those programs is pdf995 but it is NOT listed when I go to the "Remove Programs" function. I have found several other programs that do not show up in this list either, one of which is a replacement program for Acrobat Reader, which was recommended here at VDR. I don't remember the name right now.

Linda

Foxit reader is what it was :)

Fink,

You are right. It is Foxit. Can you please explain to me why this program does not appear in the list of "add/remove Programs"?

Thanks,

Linda

Have you logged in as administrator to have a look at the add/remove list? Might be worth a try.

That combofix log looks ok. Can you try the following now please;

Please download VundoFix.exe
to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HijackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when
VundoFix appears at reboot.

Fink,

FoxIt is not on the "Add/Remove Programs" list, when I am logged in as administrator. Why?

Chrunchie,

I will post the log as soon as it is finished.

Thanks,

Linda

Quote:

---

FoxIt is not on the "Add/Remove Programs" list, when I am logged in as administrator. Why?

---

I don't know but the info for that list is in the registry here...
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Uninstall

Would be worth having a look to see if it corresponds with what showing in the windows interface. If there's recent corruption in those reg entries that could be the cause. A system restore should fix it but I wouldn't do that in the middle of the procedure(s) to search/eliminate possible malware... when that's sorted you could reinstall the missing programs to see if it places the entry back where it's supposed to be in add/remove.

Chrunchie,

I downloaded VundoFix.exe and saved it as one of my programs in Windows Explorer. I ran the program and it found NO infected files but Vundo did not reboot my system, so I decided I had better do everything exactly as you stated.

So I downloaded the program again, this time to my desktop and ran it. Again no infected files were found and when I clicked remove Vundo, a dialog box popped up that said it was closing Vundo. My system did not go black and it did not reboot.

Likewise no file was generated, probably because no infected files were found.

Anyway, that is my report.

Do I need to uninstall VundoFix?

Linda

You should just be able to delete it.
Please download FileFind from Atribune:
http://www.atribune.org/downloads/FileFind.zip

Unzip the file and save it to your desktop.

To run FileFind, please do the following:

* Click on FileFind.exe
* In the box labeled "Enter the directory to search"
o Enter Drive eg.. C:\
* In the box labeled "Enter the file to search"
o Enter qrvkrn to search for the file
* Now click on the "Find" button
* Once the utility has found the files click on "Export"
* This will save a text file to your C:\ drive as "Export.txt"
* Do the same for this one; mkvrq
* Double click on Export.txt, copy and paste this information in your next post

Crunchie,

I have two hard drives on this computer and I did a search on both hard drives for

mkvrq
qrvkrn

and FileFind did not find either file. This is assuming that I entered these file names correctly.

Because FileFind did not find anything, there was no information to export.

What are these files?

Thanks Crunchie.

Linda

The file name looks very much like what Vundo creates. Some are also named in the reverse order of letters. The file name is the one you posted in your first post.
Are you still having the same problem?

Crunchie,

That was based on a post by HAN, where he reviewed the results (in my other thread) about the Kaspersky online scan.

Yes, I am still having the problems.

Thanks,

Linda

Go here and download then run Silent Runners.vbs. Right click on the download link and select Save Target As. Save it to the desktop or to a folder in a permanent directory. It generates a log which will be created in the same folder you are running it from. Please post the information back in this thread.
If you have a script blocking program, please allow the file to run. It is not malicious.

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows 2000
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"b9" = "C:\Program Files\Firetrust\Benign\B9.exe /minimize" ["Firetrust Ltd"]
"ctfmon.exe" = "ctfmon.exe" [MS]
"swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Synchronization Manager" = "mobsync.exe /logon" [MS]
"TCASUTIEXE" = "TCAUDIAG -off" [empty string]
"MULTIMEDIA KEYBOARD" = "C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe" ["Netropa Corp."]
"UpdReg" = "C:\WINNT\Updreg.exe" ["Creative Technology Ltd."]
"AtiPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"QuickTime Task" = ""D:\programs\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"NeroCheck" = "C:\WINNT\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"MailWasher" = "D:\Programs\MailWasher Pro\MailWasher Pro\MailWasher.exe" ["Firetrust Ltd"]
"InCD" = "D:\Programs\Nero InCD Packet-Writing\InCD.exe" ["Copyright (C) ahead software gmbh and its licensors"]
"DIAGENT" = "C:\Program Files\Creative\SBLive2k\Creative Diagnostics 2.0\DIAGENT.EXE startup" ["Creative Technology Ltd"]
"CreateCD50" = ""C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r" ["Roxio"]
"AHQInit" = "C:\Program Files\Creative\SBLive2k\Program\AHQInit.exe" ["Creative Technology Ltd"]
"AdaptecDirectCD" = ""C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"" ["Roxio"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"Mell Reg Reminder" = "(empty string)" [file not found]
"SCANINICIO" = ""D:\Programs\Panda Platinum 7 - 2007\Inicio.exe"" ["Panda Software"]
"APVXDWIN" = ""D:\Programs\Panda Platinum 7 - 2007\APVXDWIN.EXE" /s" ["Panda Software International"]
"Ninja" = "(empty string)" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{00C6482D-C502-44C8-8409-FCE54AD9C208}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SnagIt Toolbar Loader"
\InProcServer32\(Default) = "D:\Programs\SnagIt 8.2\SnagItBHO.dll" ["TechSmith Corporation"]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{0CF0B8EE-6596-11D5-A98E-0003470BB48E}\(Default) = "CCHelper"
-> {HKLM...CLSID} = "CCHelper Class"
\InProcServer32\(Default) = "D:\Programs\Pop-Up Stopper Companion\CCHelper.dll" [empty string]
{4A368E80-174F-4872-96B5-0B27DDD11DB2}\(Default) = "SpywareGuard Download Protection"
-> {HKLM...CLSID} = "SpywareGuardDLBLOCK.CBrowserHelper"
\InProcServer32\(Default) = "D:\Programs\SpywareGuard 2.2\SpywareGuard\dlprotect.dll" [null data]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "D:\Programs\SPYBOT~1.1\SPYBOT~1.1\SDHelper.dll" [null data]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
{7c1ce531-09e9-4fc5-9803-1c2956615786}\(Default) = "Google Desktop Search Capture"
-> {HKLM...CLSID} = "IeCaptureBho Object"
\InProcServer32\(Default) = "C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll" [null data]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar7.dll" ["Google Inc."]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEToolbarHelper Class"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat\AcroIEFavClient.dll" [null data]
{C6CEAC32-D45C-11D4-94AF-0050BABD5FD6}\(Default) = (no title provided)
-> {HKLM...CLSID} = "ieCom Class"
\InProcServer32\(Default) = "D:\Programs\URL Organizer\UrlOrgIE.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {HKLM...CLSID} = "Display Panning CPL Extension"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINNT\System32\hticons.dll" ["Hilgraeve, Inc."]
"{5E44E225-A408-11CF-B581-008029601108}" = "Adaptec DirectCD Shell Extension"
-> {HKLM...CLSID} = "Adaptec DirectCD Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\Adaptec\EASYCD~1\DirectCD\Shellex.dll" ["Roxio"]
"{8F05B1A8-9D77-4B8F-AF54-6B2202066F95}" = "Pop-Up Stopper &Companion"
-> {HKLM...CLSID} = "Pop-Up Stopper &Companion"
\InProcServer32\(Default) = "D:\Programs\Pop-Up Stopper Companion\popupus.dll" [null data]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "D:\Programs\Microsoft Office 2003\OFFICE11\msohev.dll" [MS]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "D:\PROGRAMS\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "D:\PROGRAMS\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "D:\PROGRAMS\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "D:\PROGRAMS\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "D:\Programs\MICROS~3\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "D:\Programs\MICROS~3\OFFICE11\OLKFSTUB.DLL" [MS]
"{506F4668-F13E-4AA1-BB04-B43203AB3CC0}" = "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}"
-> {HKLM...CLSID} = "ImageExtractorShellExt Class"
\InProcServer32\(Default) = "D:\Programs\Microsoft Office 2003\Visio11\VISSHE.DLL" [null data]
"{D66DC78C-4F61-447F-942B-3FB6980118CF}" = "{D66DC78C-4F61-447F-942B-3FB6980118CF}"
-> {HKLM...CLSID} = "CInfoTipShellExt Class"
\InProcServer32\(Default) = "D:\Programs\Microsoft Office 2003\Visio11\VISSHE.DLL" [null data]
"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"
-> {HKLM...CLSID} = "a² Context Menu Shell Extension"
\InProcServer32\(Default) = "D:\Programs\ASQUAR~1\A2FREE~1\A2CONT~1.DLL" [null data]
"{65756541-C65C-11CD-0000-4B656E696100}" = "Panda Antivirus"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "D:\Programs\Panda Platinum 7 - 2007\pavOLE.dll" ["Panda Software"]
"{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
-> {HKLM...CLSID} = "SpywareGuard.Handler"
\InProcServer32\(Default) = "D:\Programs\SpywareGuard 2.2\SpywareGuard\spywareguard.dll" [null data]
"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = "SnagIt"
-> {HKLM...CLSID} = "SnagIt"
\InProcServer32\(Default) = "D:\Programs\SnagIt 8.2\SnagItIEAddin.dll" ["TechSmith Corporation"]
"{CF74B903-3389-469c-B3B6-0204D204FCBD}" = "SnagIt Shell Extension"
-> {HKLM...CLSID} = "SnagItShellExt Class"
\InProcServer32\(Default) = "D:\Programs\SnagIt 8.2\SnagItShellExt.dll" ["TechSmith Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{81559C35-8464-49F7-BB0E-07A383BEF910}" = (no title provided)
-> {HKLM...CLSID} = "SpywareGuard.Handler"
\InProcServer32\(Default) = "D:\Programs\SpywareGuard 2.2\SpywareGuard\spywareguard.dll" [null data]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "PDBoot.exe" ["Raxco Software, Inc."]|"autocheck autochk *"

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "D:\Programs\Panda Platinum 7 - 2007\pavOLE.dll" ["Panda Software"]
SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}"
-> {HKLM...CLSID} = "SnagItShellExt Class"
\InProcServer32\(Default) = "D:\Programs\SnagIt 8.2\SnagItShellExt.dll" ["TechSmith Corporation"]
StuffIt Context Menu\(Default) = "{2E336DC0-54F8-11D1-ABD5-447270537467}"
-> {HKLM...CLSID} = "StuffIt Context Menu"
\InProcServer32\(Default) = "D:\Programs\StuffIt 8.0\StuffItMenu.dll" [file not found]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "D:\PROGRAMS\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}"
-> {HKLM...CLSID} = "SnagItShellExt Class"
\InProcServer32\(Default) = "D:\Programs\SnagIt 8.2\SnagItShellExt.dll" ["TechSmith Corporation"]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "D:\PROGRAMS\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
a2ContMenu\(Default) = "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"
-> {HKLM...CLSID} = "a² Context Menu Shell Extension"
\InProcServer32\(Default) = "D:\Programs\ASQUAR~1\A2FREE~1\A2CONT~1.DLL" [null data]
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "D:\Programs\Panda Platinum 7 - 2007\pavOLE.dll" ["Panda Software"]
StuffIt Context Menu\(Default) = "{2E336DC0-54F8-11D1-ABD5-447270537467}"
-> {HKLM...CLSID} = "StuffIt Context Menu"
\InProcServer32\(Default) = "D:\Programs\StuffIt 8.0\StuffItMenu.dll" [file not found]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "D:\PROGRAMS\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"CDRAutoRun" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\

"Homepage" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|
Disable changing home page settings}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Active Desktop web content (hidden if disabled):

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\
"FriendlyName" = "My Current Home Page"
"Source" = "About:Home"
"SubscribedURL" = "About:Home"

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
"MailWasherPro" -> shortcut to: "D:\Programs\MailWasher Pro\MailWasher Pro\MailWasher.exe D:\Programs\MailWasher Pro\MailWasher Pro\MailWasher.exe" ["Firetrust Ltd"]
"Microsoft Office OneNote 2003 Quick Launch" -> shortcut to: "D:\Programs\Microsoft Office 2003\OFFICE11\ONENOTEM.EXE /tsr" [MS]
"SpywareGuard" -> shortcut to: "D:\Programs\SpywareGuard 2.2\SpywareGuard\sgmain.exe" [null data]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Acrobat Assistant" -> shortcut to: "D:\Programs\Adobe\Distillr\acrotray.exe" ["Adobe Systems Inc."]
"Microsoft Office OneNote 2003 Quick Launch" -> shortcut to: "D:\Programs\Microsoft Office 2003\OFFICE11\ONENOTEM.EXE /tsr" [MS]
"NTI Ninja" -> shortcut to: "D:\Programs\NTI Ninja - USB partitioning encryption\Open.exe" ["NewTech Infosystems"]
"SnagIt 8" -> shortcut to: "D:\Programs\SnagIt 8.2\SnagIt32.exe" ["TechSmith Corporation"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
%SystemRoot%\system32\msafd.dll [MS], 1 - 3

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat\AcroIEFavClient.dll" [null data]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar7.dll" ["Google Inc."]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar7.dll" ["Google Inc."]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat\AcroIEFavClient.dll" [null data]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{8F05B1A8-9D77-4B8F-AF54-6B2202066F95}" = (no title provided)
-> {HKLM...CLSID} = "Pop-Up Stopper &Companion"
\InProcServer32\(Default) = "D:\Programs\Pop-Up Stopper Companion\popupus.dll" [null data]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat\AcroIEFavClient.dll" [null data]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar7.dll" ["Google Inc."]
"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = (no title provided)
-> {HKLM...CLSID} = "SnagIt"
\InProcServer32\(Default) = "D:\Programs\SnagIt 8.2\SnagItIEAddin.dll" ["TechSmith Corporation"]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "D:\Programs\Adobe\Acrobat\AcroIEFavClient.dll" [null data]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Research"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "D:\Programs\MICROS~3\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{2E071ADC-ADF8-4B4B-8ACB-EDC49E6D45A2}\
"ButtonText" = "Acronis*Pop-up Blocker"
"MenuText" = "Acronis Pop-up Blocker"
"CLSIDExtension" = "{2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2}"
-> {HKLM...CLSID} = "CAdBlockToolExt Object"
\InProcServer32\(Default) = "D:\Programs\ACRONI~1.0\ACRONI~1\Blocker.dll" [file not found]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

HOSTS file
----------

C:\WINNT\System32\drivers\etc\HOSTS

maps: 3 domain names to IP addresses,
2 of the IP addresses are *not* localhost!

Crunchie,

This file exceeded the maximum 20000 characters allowed, so I had to split it into two posts, see below for the 2nd part.

Thanks, I really appreciate your help.

Linda

_____________


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

3Com DMI Agent, 3ComDMIService, "C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE" ["3Com Corporation"]
ActionAgent, ActionAgent, "C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe" ["Dell Computer Corporation"]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINNT\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINNT\System32\CTsvcCDA.EXE" ["Creative Technology Ltd"]
DellDmi, DellDmi, "C:\DMI\WIN32\bin\DellDmi.exe" ["Dell Computer Corporation"]
DLT, DLT, "C:\Program Files\Dell\OpenManage\Client\DLT.exe" ["Dell Computer Corporation"]
Iap, Iap, "C:\Program Files\Dell\OpenManage\Client\Iap.exe" ["Dell Computer Corporation"]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
MSSQL$MICROSOFTBCM, MSSQL$MICROSOFTBCM, "C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe -sMICROSOFTBCM" [MS]
Netropa NHK Server, nhksrv, "C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe" [null data]
Panda anti-virus service, PAVSRV, "D:\Programs\Panda Platinum 7 - 2007\pavsrv50.exe" ["Panda Software"]
Panda Firewall Service, PAVFIRES, "D:\Programs\Panda Platinum 7 - 2007\Firewall\PavFires.exe" ["Panda Software"]
PDScheduler, PDSched, ""C:\Program Files\Raxco\PerfectDisk\PDSched.exe"" ["Raxco Software, Inc."]
Win32Sl, Win32Sl, "C:\dmi\win32\bin\Win32sl.exe" ["Intel"]

Keyboard Driver Filters:
------------------------

HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
"UpperFilters" = <<!>> "msikbd2k" ["Netropa Corporation"]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Adobe PDF Port\Driver = "C:\WINNT\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
Microsoft Office Live Meeting Document Writer Monitor\Driver = "lmdimon.dll" [MS]

----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 50 seconds, including 8 seconds for message boxes)

Not seeing anything bad in that log. Do you know where the pop ups are from?

Crunchie,

I ran Ad-Aware this morning and had 41 data miners tracking cookies and items on MRU List.

I get two dialog boxes repeatedly, which are "A Script is Running" and "Error message - Do you want to Debug".

I get the "Do you want to debug" message as many as 30-40 times for a single webpage. Part of the error message says "Object not defined".

I have all scripts blocked in my Panda configuration. I had to remove this block in order for Silent Runners to run, so I don't know what this message means or where it is coming from.

I have attached a sample of both error messages. Whatever is going on is making my system creepy slow.

Try the solution here http://support.microsoft.com/kb/175500 for the script problem.
For the runtime error, try this http://support.microsoft.com/kb/822521

Crunchie,

I will perform both of these procedures but there is one other central issue.

In the first thread, I posted the Kaspersky online scan, which identified a number of items as either trojans or a worm. In addition, twice I tried to use Panda to run a full scan of my computer ( I have two hard drives) but Panda was only able to complete 25% of the scan on my C hard drive.

So, I think that something else is going on but you are the expert in this area.

Here is the URL for my first post, which details everything that I did prior to posting this message in the HijackThis conference.

http://discussions.virtualdr.com/sho...62#post1142862

Thanks for all of your help.

Cheers,

Linda

UPDATE:

When I clicked "Post Quick Reply", I got the attached debug error message. I clicked "No" and then the message posted.

Did you follow the advice there regarding the manual deletion of those files? If so, can you do another kaspersky scan and post the results.

When I run the Kaspersky online scan, they do not make any recommendations about deleting files that I could find.

Summary Information:

1. Tried to run Panda scan twice and it failed twice.

2. SpyBot has updated their software including a registry backup. I downloaded and installed the new version 1.5.1 SpyBot. Then I checked for updates before running SpyBot. SpyBot found 6 tracking cookies which I removed and then I clicked immunize system against all exploits defined in SpyBot.

3. Ran Ad-Aware after checking for updates and it found 11 objects in MRU List -- Ad-Aware says that these are harmless but it is tracking which documents that I am using, etc.; so I don't think the designation of harmless is accurate. There were also 2 tracking cookie objects. The Tracking Cookie objects had a TAC rating of 3. I had Ad-Aware remove all.

4. Ran 2nd Kaspersky online scan and it overview report said 2 viruses and 6 infected objects as compared to the first report, which said 5 viruses and 9 infected objects. However, when I looked at the actual detail it showed 3 instances of net-worm ... (see attached) and 1 instance of email-worm (see attached.

All instances occurred in the directory where I used the program DBXpress to unpack a locked Inbox in Outlook Express. There should not be any infected files in the Inbox because they should have been caught by my various security measures.

The email-worm is reported to infect dbx files, among others.

One other pecularity is that my Google Toolbar in IE is no longer there. I went to download Google Toolbar but it wants me to enable Browser Helper Objects, which I decided not to do. I don't know if this is a good idea or not but first things first. I want to get this problem fixed first. Then I will deal with the Google Toolbar issue and switching to Kaspersky Internet Security suite. In FireFox, the Google Toolbar is still present in the browser.

Here is the Kaspersky online scan report:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 05, 2007 9:04:40 AM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 5/04/2007
Kaspersky Anti-Virus database records: 275190
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 121003
Number of viruses found: 2
Number of infected objects: 6 / 0
Number of suspicious objects: 0
Duration of the scan process: 07:56:58

Infected Object Name / Virus Name / Last Action
C:\DMI\WIN32\MifDB\errors.log Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\tmpLog.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\Training\Training archive - junk.rot135 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\Training\Training archive - legitimate.rot135 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\Trash.rot135 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\cert8.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\googlesafebrowsing.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\history.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\key3.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\parent.lock Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Business Contact Manager\MSBusinessContactManager.ldf Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Business Contact Manager\MSBusinessContactManager.mdf Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007040520070406\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF6449.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFFE3B.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0299c62c020608e5098b4319d3f79f3e_18a16916-c59e-484e-8235-a291578187d7 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\00000002.ps1 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\00000002.ps2 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\00010002.ci Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\cicat.fid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\cicat.hsh Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiCL0001.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiP10000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiP20000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiPT0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiSL0001.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiSP0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiST0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiVP0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\INDEX.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\propstor.bk1 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\propstor.bk2 Object is locked skipped
C:\Inetpub\catalog.wci\00000002.ps1 Object is locked skipped
C:\Inetpub\catalog.wci\00000002.ps2 Object is locked skipped
C:\Inetpub\catalog.wci\00010002.ci Object is locked skipped
C:\Inetpub\catalog.wci\cicat.fid Object is locked skipped
C:\Inetpub\catalog.wci\cicat.hsh Object is locked skipped
C:\Inetpub\catalog.wci\CiCL0001.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiP10000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiP20000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiPT0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiSL0001.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiSP0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiST0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiVP0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\INDEX.000 Object is locked skipped
C:\Inetpub\catalog.wci\propstor.bk1 Object is locked skipped
C:\Inetpub\catalog.wci\propstor.bk2 Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG Object is locked skipped
C:\WINNT\CSC\00000001 Object is locked skipped
C:\WINNT\DEBUG\ipsecpa.log Object is locked skipped
C:\WINNT\DEBUG\oakley.log Object is locked skipped
C:\WINNT\DEBUG\PASSWD.LOG Object is locked skipped
C:\WINNT\ModemLog_Conexant HCF V90 56K Data Fax PCI Modem.txt Object is locked skipped
C:\WINNT\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.crmlog Object is locked skipped
C:\WINNT\SCHEDLGU.TXT Object is locked skipped
C:\WINNT\SoftwareDistribution\EventCache\{3476FEA5-661E-4130-8213-16311D26AD15}.bin Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM.ALT Object is locked skipped
C:\WINNT\SYSTEM32\LogFiles\W3SVC1\ex070405.log Object is locked skipped
C:\WINNT\SYSTEM32\pavjob.log Object is locked skipped
C:\WINNT\SYSTEM32\Perflib_Perfdata_354.dat Object is locked skipped
C:\WINNT\SYSTEM32\Perflib_Perfdata_770.dat Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx/[From "Returned mail" <[email protected]>][Date Fri, 28 Oct 2005 17:21:42 -0700]/UNNAMED/document.zip/[email protected] Infected: Net-Worm.Win32.Mytob.ck skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx/[From "Returned mail" <[email protected]>][Date Fri, 28 Oct 2005 17:21:42 -0700]/UNNAMED/document.zip Infected: Net-Worm.Win32.Mytob.ck skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx/[From "Returned mail" <[email protected]>][Date Fri, 28 Oct 2005 17:21:42 -0700]/UNNAMED Infected: Net-Worm.Win32.Mytob.ck skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx Mail MS Outlook 5: infected - 3 skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\cleanup.log Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Folders.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Inbox.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\InboxBK1.dbx 634,894 KB\Output for InboxBK1.dbx\spam score 4 10pobox warning.eml/[From [email protected]][Date Wed, 18 Feb 2004 22:44:39 +0000]/mails.txt.com.b9 Infected: Email-Worm.Win32.NetSky.b skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\InboxBK1.dbx 634,894 KB\Output for InboxBK1.dbx\spam score 4 10pobox warning.eml Mail: infected - 1 skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Offline.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Pop3.log Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Pop3uidl.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Smtp.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\rawlog.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\seclog.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\syslog.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\tralog.log Object is locked skipped

Scan process completed.

Thanks for your help.

Linda

If I were you I would be deleting those backup files on 'D' you created that are coming up as infected. Whether your various security measures should have caught them or not is debatable, but imo, we should look on Kaspersky's results as being accurate :).
MRU results are fairly benign as they only show the Most Recently Used files you have accessed.

Here are the URL links on the two malware components, which Kaspersky reported on my computer.

http://www.viruslist.com/en/viruses/...?virusid=91260 -- net-worm definition in Kaspersky's malware db

http://www.viruslist.com/en/viruses/...?virusid=22745 -- Email-Worm.Win32.NetSky.b in Kaspersky's malware db

What these webpages do not say is how I got these or how to remove them.


Linda

Will deleting these files get rid of both of these worms from my system?

Or is Kaspersky just reporting that there is a worm there that has not been activated yet?

If the worms have already infected my system, how do I get rid of them.

I will delete those files.

Thanks,

Linda

Quote:

---

Or is Kaspersky just reporting that there is a worm there that has not been activated yet?

---

Yes. As I pointed out in the original thread they are currently archived in a benign state in those email archives. The only way they could be activated is if you opened those emails and those attached viruses by importing them back into the email program.

I don't think your pc was infected at any point during this procedure... the non-activated viruses in the temp int folders were deleted and now there's just these archived emails. Any other problem would now need to be fixed in a more typical method of troubleshooting (which is not by more virus scanning :) ).

That one other .ini file does appear to have been a false positive.

Thanks Fink.

This is all brand new to me, since I haven't gotten any infection or notification of infected file in 5.5 years. I will go delete those archived entries, then I will attempt to run another Panda scan followed by another Kaspersky online scan. If the Kaspersky scan comes up clean, then I will install Kaspersky.

BTW, does anyone have any idea why my Google Toolbar went poop? I made some changes in advanced mode for IE. Is there some change there, which could have made the toolbar go poop.

I will keep everyone posted.

Cheers,

Linda