Mobile/PDA About Us Advertise here
User User name Password  
  Not registered yet? Register here.
Lost your password? Click here. 		 
  Home   News   Guides   Downloads   Glossary   Hardware   Profiles   Forums   v4  
 Advertise at AfterDawn.com     Link to us!     Private messages     Compose a private message     List of all updated threads     Threads without replies     Search messages
Thursday 28.11.2024 / 13:52
Search AfterDawn Forums:        In English   Suomeksi   På svenska
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > batch file missing, more problems
Show topics
 
Forums
Forums
batch file missing, more problems
  Jump to:
 
Posted Message
sevy6788
Newbie
_ 		23. June 2006 @ 04:39 _ Link to this message    Send private message to this user   
hi im am a windows 98 user and lately i have been getting a black dos box popping up and it says

C:\>del "C:\WINDOWS\TEMP\WIN41B0.TMP>EXE"
C:\> if exist "C:\WINDOWS\TEMP\WIN41B0.TMP.EXE" goto r
C:\>del "C:\WINDOWS\TEMP\d.bat"
Batch file missing

C:\>File not found

that keeps popping up all the time and also the computer always brings up a blue screen saying something happend, and i keep getting an illegal opertation window popping up of something called "h91746" and when i hit ctrl+alt+del i see these things that i havent seen before "Raj", "Win51" "regsvr22" "Rnaapp" "Rdgus2404" "ccapp" "Rundll32" and kmy computer freezes alot too. i dont know whats wrong, could you help me?
[ + quote]

This message has been edited since posting. Last time this message was edited on 23. June 2006 @ 04:54
Advertisement
_ 		__
tapiiri
Senior Member
_ 		23. June 2006 @ 05:05 _ Link to this message    Send private message to this user   
Hi sevy6788

Send hijack this log, instructions:

http://forums.afterdawn.com/thread_view.cfm/263784
[ + quote]
Jaa- ei tuollaasia spämmäreitä ookkaa -> tapiiri

http://www.virustorjunta.net/index.php
sevy6788
Newbie
_ 		23. June 2006 @ 05:23 _ Link to this message    Send private message to this user   
heres my lf file of hijack this

Logfile of HijackThis v1.99.1
Scan saved at 9:19:18 AM, on 6/23/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBPOLL.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPCLIENT.EXE
C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMON32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\PROGRAM FILES\ORSU\RAJ.EXE
C:\WINDOWS\SYSTEM\BARS\RUNDLL32.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBMENU.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\REGSVR32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {76067E92-EE74-B7DD-5D23-BD8ED997CDC0} - C:\WINDOWS\SYSTEM\TZNSHWVO.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [3dfx Tools] rundll32.exe 3dfxCmn.dll,UpdateRegSettings
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [WINBFU32] rundll32 WINBFU32.DLL,run
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [GoBack Polling Service] C:\Program Files\Wild File\GoBack\GBPoll.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [ALU Scheduler Service] C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet
O4 - HKCU\..\Run: [Zotabnw] install program could not read the registry?CAPI: The install failed. The rsabase.dll that is being installed doesn't match the signature file or the value in the registry?CAPI: The install program could not find the signature resource5CAPI: The install prog
O4 - HKCU\..\Run: [Kov] C:\Program Files\Orsu\raj.exe
O4 - HKCU\..\Run: [Dora] "C:\WINDOWS\SYSTEM\bars\rundll32.exe" -vt yazr
O4 - Startup: GoBack.lnk = C:\Program Files\Wild File\GoBack\GBMenu.exe
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2...
O16 - DPF: {18871EA7-1B30-46DE-9283-E96E707492BA} (Playcom_ATL_Object Class) - http://www.netbabyworld.com/media/playcom/Playcom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.2.4.32/lottso/lottso-ob-assets.cab
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://home3.ca.com/PestPatrol/uniblue/pestscan/pestscan.cab
O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgUS2404.exe
O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\G151886.DLL
O20 - Winlogon Notify: AdwareAway - C:\WINDOWS\SYSTEM\ScanAtStartup.dll
[ + quote]
tapiiri
Senior Member
_ 		23. June 2006 @ 05:37 _ Link to this message    Send private message to this user   
Hi sevy6788 ,

Download eScan to your desktop -> http://www.spywareinfo.dk/download/mwav.exe
Run the file mwav.exe and unzip it to its default location, C:\Kaspersky

1. Updating the scanner (close the eScan window if open)
-> Go to My Computer
-> C:\
-> Kaspersky
-> Run the file kavupd.exe, it starts downloading updates
-> When downloading is finished, go to C:\Downloads
-> Copy all the files in the Downloads folder by pressing CTRL+A and then CTRL+C
-> Then go back to the C:\Kaspersky folder and paste the files by pressing CTRL+V
-> Answer Yes to all when it asks about replacing files
-> Now the scanner has been updated

2. Scanner settings
-> Go to folder C:\Kaspersky and run the file mwavscan.com (or mwavscan.exe)
-> The scanner window opens
-> Select the same settings than in this picture -> http://koti.mbnet.fi/pattaya1/eScan6.jpg
-> When ready, press the Scan Clean button
-> Scanning for infections begins

3. Posting the results
-> When the scan has finished (scan may take a quite long time), you'll need to post the findings
-> Copy all the text in this field -> http://koti.mbnet.fi/pattaya1/eScan10.jpg
-> Click the field, press CTRL+A, CTRL+C
-> Then open Notepad and paste the findings into a new document by pressing CTRL+V
-> Save the document to your desktop
-> Post the contents of that textfile to here
[ + quote]
Jaa- ei tuollaasia spämmäreitä ookkaa -> tapiiri

http://www.virustorjunta.net/index.php
sevy6788
Newbie
_ 		23. June 2006 @ 08:10 _ Link to this message    Send private message to this user   
ok here is the virus scan log

File C:\WINDOWS\SYSTEM\BARS\RUNDLL32.EXE infected by "Trojan-Downloader.Win32.PurityScan.cq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\NDNuninstall6_98.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.e. No Action Taken.
File C:\WINDOWS\NDNuninstall7_14.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.e. No Action Taken.
File C:\WINDOWS\NDNuninstall7_22.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.e. No Action Taken.
File C:\WINDOWS\g338191.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\compstuic.dll infected by "Trojan-Downloader.Win32.Delf.aeo" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g377939.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g1583458.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g481978.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g483098.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g5411634.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g4010144.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g2535591.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g9027319.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g14317118.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File Deleted.
File C:\WINDOWS\g15641673.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File to be deleted on reboot.
File C:\WINDOWS\g6621631.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File to be deleted on reboot.
File C:\WINDOWS\SYSTEM\winbfu32.dll infected by "Trojan.Win32.Agent.qt" Virus. Action Taken: File to be deleted on reboot.
File C:\WINDOWS\TEMP\winC173.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winC301.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winD003.TMP.exe infected by "Trojan-Dropper.Win32.VB.kk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\svshost.exe infected by "Trojan-Dropper.Win32.VB.kk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\!update.exe infected by "Trojan-Downloader.Win32.PurityScan.co" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winA132.TMP.exe infected by "Trojan-Downloader.Win32.Small.cvw" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winF0E4.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win5163.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winF1C5.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win5232.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winB294.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win9005.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win1345.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win73B2.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win2054.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win80C0.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winB393.TMP.exe infected by "Trojan-Dropper.Win32.VB.kk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win4285.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winE1B1.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winA2F1.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win4355.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winB000.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win1282.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win12F0.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win7362.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win2004.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win8066.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winE0D1.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win5194.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win1214.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win72C3.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winB360.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win4033.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win80B1.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win8086.TMP.exe infected by "Trojan-Downloader.Win32.Zlob.gen" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win8155.TMP.exe infected by "Trojan-Downloader.Win32.Zlob.gen" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win2262.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winD032.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win30A5.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win9110.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win3172.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winE380.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win5025.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winB091.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win5100.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winB163.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win4024.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winA090.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win40F3.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winA155.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win41C3.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win3005.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win7150.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win1216.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win7301.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winD383.TMP.exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\win51.TMP.exe infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\WINDOWS\TEMP\winB133.TMP.exe infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-56274691-25b87763.zip infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.26\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.27\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\popcaploader.dll tagged as not-a-virus:Downloader.Win32.PopCap.b. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.3\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.4\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.5\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.6\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.7\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.8\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.9\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.10\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.11\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.12\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.13\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.14\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.15\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.16\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.17\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.18\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.19\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.20\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.21\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.22\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.23\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.24\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.25\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.28\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.29\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.30\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.31\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.32\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.33\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.34\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.35\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.36\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Downloaded Program Files\CONFLICT.37\rdgUS2404.exe infected by "Trojan-Downloader.Win32.Small.cxq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Temporary Internet Files\Content.IE5\4F1SE6BM\srvthg[1].exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Temporary Internet Files\Content.IE5\XODPFP9J\srvutk[1].exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Temporary Internet Files\Content.IE5\XODPFP9J\rdgUS2404[1].exe infected by "Trojan-Downloader.Win32.Small.dag" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Temporary Internet Files\Content.IE5\WNQZUT69\srvjmo[1].exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Temporary Internet Files\Content.IE5\WNQZUT69\srvnpv[1].exe infected by "Trojan.Win32.Dialer.oy" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Temporary Internet Files\Content.IE5\WNQZUT69\bgates[1].exe infected by "Trojan.Win32.Dialer.pz" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Temporary Internet Files\Content.IE5\W4V8RP2H\rdgUS2405[1].exe infected by "Trojan-Downloader.Win32.Small.ayl" Virus. Action Taken: File Deleted.
File C:\WINDOWS\NDNuninstall6_98.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.e. No Action Taken.
File C:\WINDOWS\NDNuninstall7_14.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.e. No Action Taken.
File C:\WINDOWS\NDNuninstall7_22.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.e. No Action Taken.
File C:\WINDOWS\g9050488.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File to be deleted on reboot.
File C:\WINDOWS\g10387674.dll infected by "Trojan-Downloader.Win32.Delf.amb" Virus. Action Taken: File to be deleted on reboot.
File C:\My Documents\My Pictures\firebot0.2d 52.zip infected by "Trojan-Clicker.Win32.Agent.hi" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP0.wmf infected by "Trojan-Downloader.Win32.Agent.acd" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP0.class infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP1.class infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP2.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP3.class infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP4.class infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\08582D20 infected by "Trojan-Clicker.JS.Linker.p" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\63A6715F.htm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\64806E6E.htm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\2C9D4E0A infected by "Trojan-Downloader.Win32.Ani.c" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\7CBA33FF infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\78090A8F infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\227F69D6 infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\7CBD5DFB infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2A921537 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\36394411 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2A953F34 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\7C012211 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\752C5BE9 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2A996930 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\41C90010 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\1D776B3F infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\43E0183C infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2A9C132D infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\07915E0F infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\45C17A96 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\50090CCC infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2A9F3D29 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\4D593C0F infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\6E0C09ED infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AA26725 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\13211A0E infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\16561944 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\685A75EE infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AA61122 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\58EA780D infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\3EA1289A infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AA93B1E infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\1EB2560D infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\66EB37F1 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\00AA5F0F infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AAC651B infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\647A340C infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\0F364748 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\0CD353A0 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AAF0F17 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2A42120B infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\3781569E infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AB33913 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\700A700B infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\5FCB65F5 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\25243CC2 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AB66310 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\35D24E0A infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\0816754C infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\314C3152 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2AB90D0C infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\7B9B2C09 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\306004A3 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2ABD3709 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\41630A09 infected by "Trojan.Win32.Dialer.ay" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\58AB13F9 tagged as not-a-virus:AdWare.Win32.PurityScan.ak. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6E4E2644 infected by "Trojan-Dropper.Win32.VB.kk" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\186E2EA8.class infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\75870538.class infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\666B1A6B.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\1E4E7EEE.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\1740663E.class infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\17496433.class infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\728059A9.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\5A6E3013.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\6BC9357D infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\6BCD5F79 infected by "Exploit.Java.ByteVerify" Virus. Action Taken: File Renamed.
File C:\Program Files\Norton AntiVirus\Quarantine\72F12B83 infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\Norton AntiVirus\Quarantine\2D90560E infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Program Files\XoftSpy\uninstall.exe tagged as not-a-virus:RiskTool.Win32.PsKill.n. No Action Taken.
File C:\unzipped\firebot0.2d 52\install.exe infected by "Trojan-Clicker.Win32.Agent.hi" Virus. Action Taken: File Deleted.
[ + quote]
tapiiri
Senior Member
_ 		24. June 2006 @ 03:47 _ Link to this message    Send private message to this user   
Hi sevy6788
Boot your comp to safe mode

http://www.pchell.com/support/safemode.shtml

Delete those files:

C:\WINDOWS\NDNuninstall6_98.exe
C:\WINDOWS\NDNuninstall7_14.exe
C:\WINDOWS\NDNuninstall7_22.exe
C:\WINDOWS\Downloaded Program Files\popcaploader.dll
C:\Program Files\XoftSpy\uninstall.exe

Boot normally and send a fresh HijackThis log
[ + quote]
Jaa- ei tuollaasia spämmäreitä ookkaa -> tapiiri

http://www.virustorjunta.net/index.php
sevy6788
Newbie
_ 		24. June 2006 @ 23:33 _ Link to this message    Send private message to this user   
ok i deleted those files here's the fresh log

Logfile of HijackThis v1.99.1
Scan saved at 3:28:01 AM, on 6/25/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBPOLL.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPCLIENT.EXE
C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMON32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\PROGRAM FILES\ORSU\RAJ.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YCOMMON.EXE
C:\WINDOWS\SYSTEM\BARS\RUNDLL32.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBMENU.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOHMR08.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE
C:\WINDOWS\SYSTEM\HPZIPM12.EXE
C:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [3dfx Tools] rundll32.exe 3dfxCmn.dll,UpdateRegSettings
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [WINBFU32] rundll32 WINBFU32.DLL,run
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [GoBack Polling Service] C:\Program Files\Wild File\GoBack\GBPoll.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [ALU Scheduler Service] C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Zotabnw] install program could not read the registry?CAPI: The install failed. The rsabase.dll that is being installed doesn't match the signature file or the value in the registry?CAPI: The install program could not find the signature resource5CAPI: The install prog
O4 - HKCU\..\Run: [Kov] C:\Program Files\Orsu\raj.exe
O4 - HKCU\..\Run: [Dora] "C:\WINDOWS\SYSTEM\bars\rundll32.exe" -vt ndrv
O4 - Startup: GoBack.lnk = C:\Program Files\Wild File\GoBack\GBMenu.exe
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {18871EA7-1B30-46DE-9283-E96E707492BA} (Playcom_ATL_Object Class) - http://www.netbabyworld.com/media/playcom/Playcom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.2.4.32/lottso/lottso-ob-assets.cab
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://home3.ca.com/PestPatrol/uniblue/pestscan/pestscan.cab
O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgUS2404.exe
O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\G14237931.DLL
O20 - Winlogon Notify: AdwareAway - C:\WINDOWS\SYSTEM\ScanAtStartup.dll
[ + quote]
tapiiri
Senior Member
_ 		25. June 2006 @ 05:46 _ Link to this message    Send private message to this user   
Hi sevy6788

Look in your control panels add/remove programs for PuritySCAN By OIN, OuterInfo, OIN or similar , click on it and click remove.

AND
Adwareaway

Reboot and delete this folder if found:

C:\Program Files\PurityScan

If not listed, download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

http://www.outerinfo.com/howto.html
Tutorial for the uninstaller if needed

Reboot when done and delete this folder if found:
C:\Program Files\PurityScan


Find this file, it have to be deleted.
WINBFU32.DLL

If location is
C:\WINDOWS\WINBFU32.DLL
C:\WINDOWS\SYSTEM\WINBFU32.DLL

Its ok. If something else, type it path to those removed list above.

Download Killbox to your desktop -> http://www.downloads.subratam.org/KillBox.zip
Unzip it to your desktop.

Run Killbox.exe
-> Choose Delete on Reboot
-> Click All Files option.

Copy the following lines to your clipboard (choose text with your mouse, press CTRL+C or copy)

C:\WINDOWS\WINBFU32.DLL
C:\WINDOWS\SYSTEM\WINBFU32.DLL
C:\Program Files\Orsu\raj.exe
C:\WINDOWS\SYSTEM\bars\rundll32.exe
C:\WINDOWS\SYSTEM\ScanAtStartup.dll
C:\WINDOWS\G14237931.DLL


Then go back to Killbox
-> go to File
-> choose Paste from Clipboard
-> Click the red-white Delete File option.
-> Click Yes to Delete on Reboot question
-> Click OK to any PendingFileRenameOperations requests (and tell me if you get any of these!)
-> Restart your computer if Killbox won't do it.

(If you get this error when running Killbox: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid.", download Missingfilessetup.exe form here to your desktop and run the file, then try running killbox -> http://www.eudaemonia.me.uk/downloads/Files/missingfilesetup.exe)

Boot to safe mode and scan hijack and check those:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [WINBFU32] rundll32 WINBFU32.DLL,run
O4 - HKCU\..\Run: [Zotabnw] install program could not read the registry?CAPI: The install failed. The rsabase.dll that is being installed doesn't match the signature file or the value in the registry?CAPI: The install program could not find the signature resource5CAPI: The install prog
O4 - HKCU\..\Run: [Kov] C:\Program Files\Orsu\raj.exe
O4 - HKCU\..\Run: [Dora] "C:\WINDOWS\SYSTEM\bars\rundll32.exe" -vt ndrv
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgUS2404.exe
O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\G14237931.DLL
O20 - Winlogon Notify: AdwareAway - C:\WINDOWS\SYSTEM\ScanAtStartup.dll

Boot normally and send a fresh hijack log


[ + quote]
Jaa- ei tuollaasia spämmäreitä ookkaa -> tapiiri

http://www.virustorjunta.net/index.php

This message has been edited since posting. Last time this message was edited on 25. June 2006 @ 05:53
sevy6788
Newbie
_ 		25. June 2006 @ 09:57 _ Link to this message    Send private message to this user   
hi i couldnt find that purity scan thing, and i also could not find this file WINBFU32.DLL, but i did do all the other stuff. When i scanned HjT the only file i could not find was

O4 - HKCU\..\Run: [Kov] C:\Program Files\Orsu\raj.exe

and also when i had them all checked ad hit fix checked this message came up

Unexpected error occurred!
Error #53 (File not found) in Sub GetLongPath( install program could not read the registry?CAPI: The install failed. The rsabase.dll that is being installed doesn't match the signature file or the value in the registry?CAPI: The install program could not find the signature resource5CAPI: The install).

Please send a report to merijn@spywareinfo.com, mentioning what you were doing, and what version of Windows you have.

This message has been copied to your clipboard.

here is the fresh hijack log

Logfile of HijackThis v1.99.1
Scan saved at 1:53:38 PM, on 6/25/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBPOLL.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPCLIENT.EXE
C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMON32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBMENU.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\YAHOO!\BROWSER\YCOMMON.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOHMR08.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE
C:\WINDOWS\SYSTEM\HPZIPM12.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [3dfx Tools] rundll32.exe 3dfxCmn.dll,UpdateRegSettings
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [GoBack Polling Service] C:\Program Files\Wild File\GoBack\GBPoll.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [ALU Scheduler Service] C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - Startup: GoBack.lnk = C:\Program Files\Wild File\GoBack\GBMenu.exe
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {18871EA7-1B30-46DE-9283-E96E707492BA} (Playcom_ATL_Object Class) - http://www.netbabyworld.com/media/playcom/Playcom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.2.4.32/lottso/lottso-ob-assets.cab
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://home3.ca.com/PestPatrol/uniblue/pestscan/pestscan.cab
[ + quote]
tapiiri
Senior Member
_ 		25. June 2006 @ 11:03 _ Link to this message    Send private message to this user   
Okei, now log looks fine.

Is problem away ?


[ + quote]
Jaa- ei tuollaasia spämmäreitä ookkaa -> tapiiri

http://www.virustorjunta.net/index.php
sevy6788
Newbie
_ 		26. June 2006 @ 15:00 _ Link to this message    Send private message to this user   
yes it looks fine now, thank you
[ + quote]
Advertisement
_ 		__
 
_
tapiiri
Senior Member
_ 		27. June 2006 @ 08:45 _ Link to this message    Send private message to this user   
You're welcome
[ + quote]
Jaa- ei tuollaasia spämmäreitä ookkaa -> tapiiri

http://www.virustorjunta.net/index.php
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > batch file missing, more problems
 

Digital video: AfterDawn.com | AfterDawn Forums
Music: MP3Lizard.com
Gaming: Blasteroids.com | Blasteroids Forums | Compare game prices
Software: Software downloads
Blogs: User profile pages
RSS feeds: AfterDawn.com News | Software updates | AfterDawn Forums
International: AfterDawn in Finnish | AfterDawn in Swedish | AfterDawn in Norwegian | download.fi
Navigate: Search | Site map
About us: About AfterDawn Ltd | Advertise on our sites | Rules, Restrictions, Legal disclaimer & Privacy policy
Contact us: Send feedback | Contact our media sales team
 
  © 1999-2024 by AfterDawn Ltd.

  IDG TechNetwork