 Hijackthis And Kaspersky Logs, My comp is sick |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 May 10 2008, 05:32 PM
Post
#1
|
|
|
Member  Group: Members Posts: 17 Joined: 17-April 08 Member No.: 203,668  |
Thanks a ton. Post 1. http://www.bleepingcomputer.com/forums/topic142391.html Post 2. http://www.bleepingcomputer.com/forums/topic145913.html HijackThis Logs: Deckard's System Scanner v20071014.68 Run by VIKRANT on 2008-05-10 23:00:32 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 21: 2008-05-10 22:00:52 UTC - RP700 - Deckard's System Scanner Restore Point 20: 2008-05-09 19:59:45 UTC - RP699 - System Checkpoint 19: 2008-05-08 19:12:10 UTC - RP698 - System Checkpoint 18: 2008-05-04 15:00:18 UTC - RP697 - System Checkpoint 17: 2008-05-03 09:31:57 UTC - RP696 - System Checkpoint -- First Restore Point -- 1: 2008-04-17 06:42:14 UTC - RP680 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 511 MiB (512 MiB recommended). -- HijackThis (run as VIKRANT.exe) --------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:07:28, on 10/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Apoint\Apoint.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\ATK0100\Hcontrol.exe C:\WINDOWS\system32\ICO.EXE C:\Program Files\Sony\HotKey Utility\HKserv.exe C:\Program Files\sony\vaio power management\SPMgr.exe C:\Program Files\sony\vaio update 2\VAIOUpdt.exe C:\WINDOWS\System32\ezSP_Px.exe C:\Program Files\Sony\ISB Utility\ISBMgr.exe C:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe C:\Program Files\sony\click to dvd\ctdatsvr.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Sony\HotKey Utility\HKWnd.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\VIKRANT\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\VIKRANT.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi...fo/bt_side.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll O2 - BHO: {930fcd69-c068-a019-1de4-e38e50af6066} - {6606fa05-e83e-4ed1-910a-860c96dcf039} - C:\WINDOWS\system32\awrhrkjf.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: nextads browser optimizer - {aabe7a7b-0513-fb8b-42b3-20132ef62984} - C:\WINDOWS\system32\{6de4c90b-db75-88e0-4afc-6d1737d419c2}.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: (no name) - {D569B38B-400B-40B8-A5D2-63A23B5F663C} - C:\WINDOWS\system32\jkkjjggf.dll (file missing) O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O2 - BHO: (no name) - {FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2} - C:\WINDOWS\system32\gebyvsqq.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\sony\vaio power management\SPMgr.exe O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\sony\vaio update 2\VAIOUpdt.exe" /Stationary O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exe /StartUp O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{6de4c90b-db75-88e0-4afc-6d1737d419c2}.dll" DllInit O4 - HKLM\..\Run: [14be5ac6] rundll32.exe "C:\WINDOWS\system32\oixygasy.dll",b O4 - HKLM\..\Run: [BM178d695a] Rundll32.exe "C:\WINDOWS\system32\fmybkljx.dll",s O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Click to DVD Automatic Mode Launcher.lnk = C:\Program Files\sony\click to dvd\ctdatsvr.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Image Transfer.lnk = ? O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing) O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.sony-europe.com O15 - Trusted Zone: *.sonystyle-europe.com O15 - Trusted Zone: *.vaio-link.com O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/instal...nosticsxp2k.cab O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: gebyvsqq - gebyvsqq.dll (file missing) O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\sony\vaio media music server\SSSvr.exe O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\vaio media platform\sv_httpd.exe O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\vaio media platform\UPnPFramework.exe O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exe O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE -- End of file - 12757 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys R2 MASPINT - c:\windows\system32\drivers\maspint.sys <Not Verified; MicroStaff Co.,Ltd.; Aspi32 Driver for WinNT> R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> S1 Uim_IM (UIM Drive Backup Image Plugin) - c:\windows\system32\drivers\uim_im.sys (file missing) S1 UimBus (Universal Image Mounter Controller) - c:\windows\system32\drivers\uimbus.sys (file missing) S3 grmn0200 (grmn0200.Sys Garmin USB DCP driver (install)) - c:\windows\system32\drivers\grmn0200.sys <Not Verified; GARMIN Corp.; grmn0200> S3 grmn1200 (grmn0200.Sys Garmin USB DCP driver) - c:\windows\system32\drivers\grmn1200.sys <Not Verified; GARMIN Corp.; grmn1200> S3 MRENDIS5 (MRENDIS5 NDIS Protocol Driver) - c:\progra~1\common~1\motive\mrendis5.sys (file missing) S3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus® ASPI Shell> S3 Ser2pl (Prolific Serial port driver) - c:\windows\system32\drivers\ser2pl.sys <Not Verified; Prolific Technology Inc.; Prolific USB-to-Serial Bridge Cable> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S3 PACSPTISVR - c:\program files\common files\sony shared\avlib\pacsptisvr.exe <Not Verified; ; PACSPTISVR Module> S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> S3 YPCService - c:\windows\system32\ypcser~1.exe <Not Verified; Yahoo! Inc.; YPCService Module> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-04-06 16:32:30 348 --a------ C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 2400 series#1207495736.job -- Files created between 2008-04-10 and 2008-05-10 ----------------------------- 2008-05-10 23:06:09 0 d-------- C:\Program Files\Trend Micro 2008-05-09 23:47:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-09 23:47:40 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-09 23:47:37 0 d-------- C:\WINDOWS\LastGood 2008-05-09 23:11:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla 2008-05-05 10:37:32 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-05-05 10:14:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-05-05 10:14:24 0 dr-h----- C:\Documents and Settings\Administrator\Recent 2008-05-05 10:13:37 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2008-05-05 10:13:37 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2008-05-05 10:13:37 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2008-05-05 10:13:37 0 dr------- C:\Documents and Settings\Administrator\My Documents 2008-05-05 10:13:37 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2008-05-05 10:13:37 0 dr------- C:\Documents and Settings\Administrator\Favorites 2008-05-05 10:13:37 0 d-------- C:\Documents and Settings\Administrator\Desktop 2008-05-05 10:13:37 0 d--hs---- C:\Documents and Settings\Administrator\Cookies 2008-05-05 10:13:37 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2008-05-05 10:13:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-05-05 10:13:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2008-05-05 10:13:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sony Corporation 2008-05-05 10:13:37 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2008-05-05 10:13:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2008-05-05 10:13:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2008-05-05 10:13:36 0 d--h----- C:\Documents and Settings\Administrator\Templates 2008-05-05 10:13:36 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2008-05-05 10:13:35 1310720 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2008-05-04 15:12:42 1506573 ---hs---- C:\WINDOWS\system32\ysagyxio.ini2 2008-05-04 06:51:59 0 d-------- C:\Documents and Settings\TINA\Contacts 2008-05-03 11:14:48 0 d-------- C:\Documents and Settings\TINA\Application Data\Mozilla 2008-05-03 11:14:07 0 d-------- C:\Documents and Settings\TINA\Application Data\AVG7 2008-04-25 15:39:30 329728 --a------ C:\WINDOWS\system32\{6de4c90b-db75-88e0-4afc-6d1737d419c2}.dll 2008-04-20 10:46:12 1160 --a------ C:\WINDOWS\mozver.dat 2008-04-18 19:01:10 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-04-18 19:00:56 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-04-18 19:00:56 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\SUPERAntiSpyware.com 2008-04-18 19:00:10 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-04-18 18:44:17 921 --a------ C:\WINDOWS\QSFVExit.bat 2008-04-17 22:06:59 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\Mozilla 2008-04-17 17:56:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-17 00:04:03 100686 --a------ C:\WINDOWS\system32\oixygasy.dll 2008-04-17 00:03:52 105642 -----n--- C:\WINDOWS\system32\fmybkljx.dll 2008-04-16 23:45:49 243445 --ahs---- C:\WINDOWS\system32\fggjjkkj.ini2 2008-04-16 23:45:17 0 d-------- C:\Program Files\AntiSpywareMaster 2008-04-16 23:40:44 0 d-------- C:\WINDOWS\system32\id3 2008-04-16 23:40:44 0 d-------- C:\WINDOWS\system32\gui4 2008-04-16 23:40:44 0 d-------- C:\WINDOWS\system32\ginp 2008-04-16 23:40:44 0 d-------- C:\WINDOWS\system32\ace2 2008-04-16 23:40:13 0 d-------- C:\WINDOWS\system32\xcsDd01 2008-04-16 22:03:20 1262956 --a------ C:\WINDOWS\system32\XMNT2001.EXE 2008-04-16 22:03:20 3252 --a------ C:\WINDOWS\system32\drivers\PQNTDRV.SYS 2008-04-16 22:03:03 0 d-------- C:\Program Files\PowerQuest 2008-04-15 07:36:38 0 d-------- C:\Program Files\QuickSFV 2008-04-13 15:14:07 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\vlc 2008-04-13 15:12:55 0 d-------- C:\Program Files\VideoLAN 2008-04-13 14:48:42 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\WinRAR -- Find3M Report --------------------------------------------------------------- 2008-05-10 10:30:09 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\AVG7 2008-04-18 19:00:10 0 d-------- C:\Program Files\Common Files 2008-04-17 00:21:22 0 d-------- C:\Program Files\Paragon Software 2008-04-16 22:03:12 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-04-15 18:21:39 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\AdobeUM 2008-04-06 16:25:23 0 d-------- C:\Program Files\HP 2008-03-24 21:52:46 0 d-------- C:\Program Files\Replay Media Catcher 2008-03-24 21:52:02 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\GetRightToGo 2008-03-24 21:50:06 0 d-------- C:\Program Files\FLV Player 2008-03-24 21:15:09 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\Adobe 2008-03-24 21:12:50 0 d-------- C:\Program Files\DivX 2008-03-24 19:36:06 0 d-------- C:\Documents and Settings\VIKRANT\Application Data\Apple Computer 2008-03-24 19:34:04 0 d-------- C:\Program Files\QuickTime 2008-03-24 19:31:39 0 d-------- C:\Program Files\Apple Software Update 2008-02-21 03:05:44 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-02-21 03:04:16 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2008-02-21 03:04:16 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2008-02-21 03:04:04 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2008-02-21 03:04:04 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2008-02-21 03:04:04 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2008-02-21 03:04:04 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2008-02-21 03:03:24 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6606fa05-e83e-4ed1-910a-860c96dcf039}] C:\WINDOWS\system32\awrhrkjf.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{aabe7a7b-0513-fb8b-42b3-20132ef62984}] 25/04/2008 15:39 329728 --a------ C:\WINDOWS\system32\{6de4c90b-db75-88e0-4afc-6d1737d419c2}.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D569B38B-400B-40B8-A5D2-63A23B5F663C}] C:\WINDOWS\system32\jkkjjggf.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2}] C:\WINDOWS\system32\gebyvsqq.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [07/11/2003 17:21] "ATIModeChange"="Ati2mdxx.exe" [04/09/2001 16:24 C:\WINDOWS\system32\Ati2mdxx.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [03/03/2004 13:00] "Hcontrol"="C:\WINDOWS\ATK0100\Hcontrol.exe" [19/09/2003 17:42] "Mouse Suite 98 Daemon"="ICO.EXE" [14/03/2002 17:46 C:\WINDOWS\system32\ico.exe] "BluetoothAuthenticationAgent"="irprops.cpl" [04/08/2004 08:56 C:\WINDOWS\system32\irprops.cpl] "HKSERV.EXE"="C:\Program Files\Sony\HotKey Utility\HKserv.exe" [13/02/2004 00:01] "SonyPowerCfg"="C:\Program Files\sony\vaio power management\SPMgr.exe" [12/12/2003 00:03] "VAIO Update 2"="C:\Program Files\sony\vaio update 2\VAIOUpdt.exe" [17/01/2004 04:36] "ezShieldProtector for Px"="C:\WINDOWS\System32\ezSP_Px.exe" [20/08/2002 10:29] "ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [20/02/2004 15:12] "Drag'n Drop CD+DVD"="C:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exe" [02/02/2004 19:59] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [01/02/2008 00:13] "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [09/12/2003 13:03] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [15/04/2008 09:46] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [25/06/2003 11:24] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [26/06/2003 18:50] "spa_start"="C:\WINDOWS\system32\{6de4c90b-db75-88e0-4afc-6d1737d419c2}.dll" [25/04/2008 15:39] "14be5ac6"="C:\WINDOWS\system32\oixygasy.dll" [17/04/2008 00:04] "BM178d695a"="C:\WINDOWS\system32\fmybkljx.dll" [17/04/2008 00:03] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [13/07/2004 21:17] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [19/01/2007 12:54] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [11/06/2007 18:16] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [10/02/2008 13:31] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 16:45] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 08:56] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [29/02/2008 16:03] C:\Documents and Settings\VIKRANT\Start Menu\Programs\Startup\ Click to DVD Automatic Mode Launcher.lnk - C:\Program Files\sony\click to dvd\ctdatsvr.exe [00:00:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [30/07/2003 03:52:00] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [24/09/2005 07:05:26] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [10/02/2008 13:31:52] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [07/07/2003 01:20:40] Image Transfer.lnk - C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe [02/10/2004 12:15:39] Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [13/07/2004 21:38:02] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13/02/2001 01:01:04] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2}"= C:\WINDOWS\system32\gebyvsqq.dll [ ] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19/04/2007 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyvsqq] gebyvsqq.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkjjggf [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-05-10 23:11:55 ------------ Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel® Pentium® M processor 1500MHz Percentage of Memory in Use: 81% Physical Memory (total/avail): 510.8 MiB / 94.39 MiB Pagefile Memory (total/avail): 1247.89 MiB / 524.43 MiB Virtual Memory (total/avail): 2047.88 MiB / 1924.2 MiB C: is Fixed (NTFS) - 41.86 GiB total, 17.44 GiB free. D: is Fixed (NTFS) - 14.03 GiB total, 14.02 GiB free. E: is Removable (No Media) F: is CDROM (No Media) \\.\PHYSICALDRIVE1 - MemoryStick or MemoryStickPro Device \\.\PHYSICALDRIVE0 - IC25N060ATMR04-0 - 55.89 GiB - 2 partitions \PARTITION0 (bootable) - Installable File System - 41.86 GiB - C: \PARTITION1 - Extended w/Extended Int 13 - 14.03 GiB - D: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. AV: AVG 7.5.524 v7.5.524 (Grisoft) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger" "C:\\WINDOWS\\system32\\ntvdm.exe"="C:\\WINDOWS\\system32\\ntvdm.exe:*:Disabled:NTVDM.EXE" "C:\\Ortho\\SERVER32.EXE"="C:\\Ortho\\SERVER32.EXE:*:Disabled:WEBRAMI2" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Adobe\\Acrobat 6.0\\Acrobat Elements\\Acrobat Elements.exe"="C:\\Program Files\\Adobe\\Acrobat 6.0\\Acrobat Elements\\Acrobat Elements.exe:*:Enabled:Adobe Acrobat Elements 6.0" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe" "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\VIKRANT\Application Data CLASSPATH=.;C:\Program Files\Java\j2re1.4.2_03\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=VIKTINA ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\VIKRANT LOGONSERVER=\\VIKTINA NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0905 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\j2re1.4.2_03\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\VIKRANT\LOCALS~1\Temp TMP=C:\DOCUME~1\VIKRANT\LOCALS~1\Temp USERDOMAIN=VIKTINA USERNAME=VIKRANT USERPROFILE=C:\Documents and Settings\VIKRANT windir=C:\WINDOWS __COMPAT_LAYER=DisableNXShowUI -- User Profiles --------------------------------------------------------------- VIKRANT (admin) TINA (admin) Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-000000000001} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf AC3Filter (remove only) --> C:\Program Files\AC3Filter\uninstall.exe Adobe Acrobat Elements 6.0 --> MsiExec.exe /I{E5E6E687-1033-BA7E-6000-000000000001} Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Photoshop Album 2.0 Starter Edition --> MsiExec.exe /I{11B569C2-4BF6-4ED0-9D17-A4273943CB24} Adobe Premiere Standard --> RunDll32 "C:\Program Files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{7998F67D-655B-42E3-B651-18D96DD17268}\setup.exe" Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002} Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4} Applian FLV Player --> "C:\WINDOWS\Applian FLV Player\uninstall.exe" "/U:C:\Program Files\FLV Player\Uninstall\uninstall.xml" ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Control Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe" ATI Display Driver --> rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean ATK0100 ACPI UTILITY --> C:\WINDOWS\ATK0100\XPunin.exe AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe BT Yahoo! Applications --> C:\PROGRA~1\Yahoo!\Common\uninstall.exe Click to DVD 1.4.02 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7C2F71B2-6C73-11D6-B659-00C04F790F76}\setup.exe" DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Content Uploader --> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER DivX Converter --> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN Drag'n Drop CD+DVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DDC146FA-73E0-4FA1-A353-841EA14BF600}\Setup.exe" -l0x9 deleteall DVgate Plus --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{685BCC47-B8EC-45EC-BBCE-77DF2451502C}\setup.exe" Enhancement Browser Tools Nextads --> C:\WINDOWS\system32\{6de4c90b-db75-88e0-4afc-6d1737d419c2}.dll-uninst.exe Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29} Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll" Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" HotKey Utility --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BB311F54-39D6-4A03-8E18-053D1B2833D7}\Setup.exe" -l0x9 HP Driver Diagnostics --> MsiExec.exe /I{16BE87BC-69F5-4D36-8CF0-E1CB3ACD5ED3} HP Photo & Imaging 3.1 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat HP PSC & OfficeJet 3.0 --> "C:\Program Files\HP\Digital Imaging\{6CF9C6C0-54E5-4668-85C1-C10F63C40155}\setup\hpzscr01.exe" -datfile hposcr03.dat HP Software Update --> MsiExec.exe /X{CC0A24CB-87C9-4F1C-A1F2-F87D8D4DDCAF} Image Transfer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{564A8DD3-70BC-4018-A5C3-7CEB10BBB6E9}\Setup.exe" -l0x9 UNINSTALL ImageMixer for Sony --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1B4AA674-F5CA-4BB5-831A-CD37B4021959}\Setup.exe" -l0x9 Intel® PRO Network Adapters and Drivers --> Prounstl.exe InterVideo WinDVD 5 for VAIO --> "C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL Java 2 Runtime Environment, SE v1.4.2_03 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030} Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0x9 UNINSTALL Logitech Print Service --> C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG Logitech® Camera Driver --> "C:\Program Files\Common Files\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT Macromedia Flash Player --> MsiExec.exe /X{27579b3c-5470-4496-be6c-0c872674f19f} MapSource --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5E3CFCA6-C95A-47CB-A822-7FA80D423AF2}\Setup.exe" -l0x9 AddRemove MapSource - European City Navigator v6 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{78FAC9DA-E0A7-45BA-B9E1-181CB57C6D1C} /l1033 Memories Disc Creator 2.0 --> MsiExec.exe /X{2E132061-C78A-48D4-A899-1D13B9D189FA} Memory Stick Formatter --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{27337663-2619-11D4-99DC-0000F49094C7}\Setup.exe" -l0x9 /UNINSTALL Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office XP Standard --> MsiExec.exe /I{91120409-6000-11D3-8CFE-0050048383C9} Microsoft User-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe" Microsoft Works 7.0 --> MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84} MicroStaff WINASPI --> C:\MWASPI\uninst.exe MoodLogic --> C:\WINDOWS\ml-uninstall-v10.exe Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe My Info Centre --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{62B715BC-01F5-4CC9-9811-D24ED44C16D4} OpenMG Limited Patch 3.4-03-12-16-01 --> C:\Program Files\Common Files\Sony Shared\OpenMG\HotFixes\HotFix3.4-03-12-16-01\HotFixSetup\setup.exe /u OpenMG Secure Module 3.4.00 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{657DD6DA-B07B-40FF-9DBD-2116F7E83CF6}\setup.exe" -l0xa UNINSTALL PC Connectivity Solution --> MsiExec.exe /I{066D65EA-ED53-44E4-A96A-F81B6E409D2E} PC Logbook --> MsiExec.exe /I{BC8FC275-24FC-43AA-8ABC-7D7FEB7D3987} PowerQuest PartitionMagic 7.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1E5007FA-DA5E-4EDD-BDE5-14D128D66887}\Setup.exe" QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067} RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe" Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe" Shockwave --> C:\WINDOWS\system32\Macromed\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~2\Install.log SoftV92 Data Fax Modem --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_818C104D\HXFSETUP.EXE -U -IVEN_8086&DEV_24C6&SUBSYS_818C104D SonicStage 2.0.02 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{71D6CE84-B7DC-4166-8E0D-56C1C37BFB5A}\setup.exe" -l0x9 UNINSTALL Sony Notebook Setup --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{936FADC9-C609-471A-B6F2-A33E2E660D1A}\Setup.exe" -l0x9 Sony USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}\Setup.exe" UNINSTALL Sony USB Mouse --> Pmuninst.exe MouseSuite98 Sony Utilities DLL --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF3D45BB-2260-4008-88EA-492E7744A9DF}\Setup.exe" -l0x9 Sony Video Shared Library --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6990A2BF-D1D2-11D3-81BC-00609789C908}\setup.exe" SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} VAIO Edit Components --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{761C9026-14F0-4352-8658-934558272404}\setup.exe" VAIO GrandBlue Wallpaper --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D8E2BDAE-4AEB-464D-A410-89AF090B08D9}\Setup.exe" -l0x9 VAIO Media 2.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1EB317D8-8945-4FD6-B37F-DF470317C6AB}\Setup.exe" -l0x9 UNINSTALL VAIO Media Music Server 2.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DF733005-0F40-11D6-9254-0000F460E7A9}\Setup.exe" -l0x9 UNINSTALL VAIO Media Photo Server 2.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6587A1E-A87D-4CF9-9BA6-CE2CEB58950E}\Setup.exe" -l0x9 VAIO Media Platform 2.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DF0DD6E9-F673-4466-8353-70B50A506FD9}\setup.exe" VAIO Media Redistribution 2.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7128C69B-8F7E-4336-8698-3FD3CDD955EC}\Setup.exe" -l0x9 UNINSTALL VAIO Media Setup 2.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2D9D1CE4-8C3D-469A-9894-0857B6C9F426}\Setup.exe" -l0x9 VAIO Online Registration (English) --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{668B1BD6-4593-4959-970E-249AFFE6F35C} /l2057 VAIO Power Management --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{545DB151-1514-4FFC-BF2F-FE8FBBD06987}\Setup.exe" -l0x9 VAIO Product Survey (English) --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{9080C5D2-82FA-452A-87FA-CBB4B05D67A5} /l2057 VAIO SLIT-A Screen Saver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8D324F1B-A39E-4D5A-BA58-147416FE019A}\Setup.exe" -l0x9 VAIO SLIT-B Screen Saver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3600FB01-C63B-4A3D-B044-BB21792C6811}\Setup.exe" -l0x9 VAIO SLIT-C Screen Saver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01AF4645-78E6-46C4-B528-54863679CC40}\Setup.exe" -l0x9 VAIO SLIT Pattern Wallpaper --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{266AEE68-5718-4A31-BDD3-D356B1250C70}\Setup.exe" -l0x9 VAIO SLIT Scene Wallpaper --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A17456ED-3432-49FF-A14D-E0F00A96A2AA}\Setup.exe" -l0x9 VAIO Update 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48820099-ED7D-424B-890C-9A82EF00656C}\Setup.exe" -l0x9 VideoLAN VLC media player 0.8.6f --> C:\Program Files\VideoLAN\VLC\uninstall.exe Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F} Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe -- Application Event Log ------------------------------------------------------- Event Record #/Type10530 / Error Event Submitted/Written: 05/09/2008 11:22:17 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application firefox.exe, version 1.8.20080.40413, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type10525 / Error Event Submitted/Written: 05/08/2008 07:44:18 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application firefox.exe, version 1.8.20080.40413, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type10524 / Error Event Submitted/Written: 05/08/2008 07:44:18 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application firefox.exe, version 1.8.20080.40413, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type10511 / Error Event Submitted/Written: 05/04/2008 06:21:10 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application WINWORD.EXE, version 10.0.6612.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type10506 / Success Event Submitted/Written: 05/04/2008 06:52:52 AM Event ID/Source: 12001 / usnjsvc Event Description: The Messenger Sharing USN Journal Reader service started successfully. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type35868 / Warning Event Submitted/Written: 05/10/2008 10:29:20 PM Event ID/Source: 36 / W32Time Event Description: The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized. Event Record #/Type35820 / Error Event Submitted/Written: 05/09/2008 11:11:58 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Event Record #/Type35819 / Error Event Submitted/Written: 05/09/2008 11:09:53 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} Event Record #/Type35818 / Error Event Submitted/Written: 05/09/2008 11:07:32 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} Event Record #/Type35817 / Error Event Submitted/Written: 05/09/2008 11:06:22 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} -- End of Deckard's System Scanner: finished at 2008-05-10 23:11:55 ------------ Kaspersky Log1 KASPERSKY ONLINE SCANNER REPORT Saturday, May 10, 2008 2:43:51 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 9/05/2008 Kaspersky Anti-Virus database records: 750464 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer C:\ D:\ E:\ F:\ Scan Statistics Total number of scanned objects 83784 Number of viruses found 3 Number of infected objects 4 Number of suspicious objects 0 Duration of the scan process 02:16:48 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\VIKRANT\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-5-9-2008( 23-13-34 ).LOG Object is locked skipped C:\Documents and Settings\VIKRANT\Cookies\index.dat Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\History\History.IE5\MSHist012008051020080511\index.dat Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\Temp\~ROMFN_00000808 Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\VIKRANT\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\VIKRANT\NTUSER.DAT Object is locked skipped C:\Documents and Settings\VIKRANT\NTUSER.DAT.LOG Object is locked skipped C:\hpcmerr.log Object is locked skipped C:\Program Files\AntiSpywareMaster\asm.exe Infected: not-a-virus:FraudTool.Win32.AntiSpywareMaster skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\chandir.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\chandir.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\chn.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\chn.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\D0000000.FCS Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\inuse.txt Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\L0000167.FCS Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\main.log Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_die.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_die.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_dnd.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_dnd.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_ext.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_ext.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_rcv.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\prs_rcv.idx Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\storydb.dat Object is locked skipped C:\Program Files\Logitech\Desktop Messenger\8876480\Users\VIKRANT\Data\storydb.idx Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{629181FC-84B0-48A6-BE94-381C083611C2}\RP687\A0055147.dll Object is locked skipped C:\System Volume Information\_restore{629181FC-84B0-48A6-BE94-381C083611C2}\RP690\A0056164.exe Object is locked skipped C:\System Volume Information\_restore{629181FC-84B0-48A6-BE94-381C083611C2}\RP691\A0056210.dll Infected: Trojan.Win32.Zapchast.gc skipped C:\System Volume Information\_restore{629181FC-84B0-48A6-BE94-381C083611C2}\RP692\A0056317.dll Object is locked skipped C:\System Volume Information\_restore{629181FC-84B0-48A6-BE94-381C083611C2}\RP695\A0056432.dll Object is locked skipped C:\System Volume Information\_restore{629181FC-84B0-48A6-BE94-381C083611C2}\RP699\change.log Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hh.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhctrl.ocx Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\itircl.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\itss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shdocvw.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shell32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shmedia.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\urlmon.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\dhcpcsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\ndis.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\ndisuio.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\netshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcdlg.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcsapi.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\xpsp2res.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\wmp.dll Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. Kaspersky Log2 KASPERSKY ONLINE SCANNER REPORT Saturday, May 10, 2008 2:48:04 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 9/05/2008 Kaspersky Anti-Virus database records: 750464 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target Memory Scan Statistics Total number of scanned objects 3004 Number of viruses found 1 Number of infected objects 72 Number of suspicious objects 0 Duration of the scan process 00:01:25 Infected Object Name Virus Name Last Action [0] [System Process] => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [0] [System Process] => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [424] explorer.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [424] explorer.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [1624] Apoint.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [1624] Apoint.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [556] atiptaxx.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [556] atiptaxx.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [616] Hcontrol.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [616] Hcontrol.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [636] ico.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [636] ico.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [1472] HKServ.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [1472] HKServ.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [572] SPMgr.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [572] SPMgr.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [1576] VAIOUpdt.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [1576] VAIOUpdt.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [1604] ezSP_Px.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [1604] ezSP_Px.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [996] ISBMgr.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [996] ISBMgr.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2056] DragDrop.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2056] DragDrop.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2204] ybrwicon.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2204] ybrwicon.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2212] avgcc.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2212] avgcc.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2220] hpwuSchd.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2220] hpwuSchd.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2256] hpcmpmgr.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2256] hpcmpmgr.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2264] rundll32.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2264] rundll32.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2272] rundll32.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2272] rundll32.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2292] rundll32.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2292] rundll32.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2324] backWeb-8876480.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2324] backWeb-8876480.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2352] msnmsgr.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2352] msnmsgr.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2576] ctfmon.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2576] ctfmon.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2584] ycommon.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2584] ycommon.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2600] SUPERAntiSpyware.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2600] SUPERAntiSpyware.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2652] iexplore.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2652] iexplore.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2684] acrotray.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2684] acrotray.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2700] ApntEx.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2700] ApntEx.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2736] GoogleUpdater.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2736] GoogleUpdater.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2752] hpqtra08.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2752] hpqtra08.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2760] SonyTray.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2760] SonyTray.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [2972] ctdatsvr.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [2972] ctdatsvr.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [3120] ATKOSD.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [3120] ATKOSD.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [3192] HKWnd.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [3192] HKWnd.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [4008] Ymsgr_tray.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [4008] Ymsgr_tray.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [4040] WLLoginProxy.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [4040] WLLoginProxy.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped [3440] iexplore.exe => C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped [3440] iexplore.exe => C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped Scan process completed. Kaspersky Log3 KASPERSKY ONLINE SCANNER REPORT Saturday, May 10, 2008 4:57:16 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 9/05/2008 Kaspersky Anti-Virus database records: 750464 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target Critical Areas C:\WINDOWS C:\DOCUME~1\VIKRANT\LOCALS~1\Temp\ Scan Statistics Total number of scanned objects 31380 Number of viruses found 1 Number of infected objects 2 Number of suspicious objects 0 Duration of the scan process 00:41:30 Infected Object Name Virus Name Last Action C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hh.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhctrl.ocx Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\itircl.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\itss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shdocvw.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shell32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\shmedia.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\urlmon.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\dhcpcsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\ndis.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\ndisuio.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\netshell.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcdlg.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcsapi.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\wzcsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB826942$\xpsp2res.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\wmp.dll Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\DEFAULT.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\SYSTEM.LOG Object is locked skipped C:\WINDOWS\system32\fmybkljx.dll Infected: Trojan.Win32.Zapchast.gb skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\oixygasy.dll Infected: Trojan.Win32.Zapchast.gb skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\DOCUME~1\VIKRANT\LOCALS~1\Temp\~ROMFN_00000808 Object is locked skipped Scan process completed. It looks like its infected by 'Trojan.Win32.Zapchast.gb'  |
 |
 
|
|
May 11 2008, 02:49 AM
Post
#2
|
|
 Malware Killer Dog Group: HJT Team Posts: 15,009 Joined: 18-February 05 From: Belgium Member No.: 12,408 |
