Hijack This Log

chi-chi · March 2008

I want to improve the performance of my PC and wanted to post my Hijack this log to see if there where any major issues that stood out? The problem is when I hit save log file after doing a HJT scan I cant seem to find the location it is saving the log file? I tried looking to see if i change the default drive but can seem to find that either? If some on can help me with this I would appreciate it so I can post my log in this thread, thanks in advance.

Niels · March 2008

Dear chi-chi,

Please check the following locations: my documents folder or on your desktop. If not there check Trend Micro subfolder that you will find in the Program Files folder more specificly in the Hijack This subfolder.

Best regards

Niels

Unknown · March 2008

Please download this http://students.info.uaic.ro/~daniel.chipi...BDAspySetup.exe and install it. Then you can make a decent startup list from the "SysLog" tab. The path to the log is mentioned in the "Path to log file" textbox.

Good luck.

chi-chi · March 2008

I hae checked there and even did an unhide of folders its not in any of those locations?? Is there a way within the program to just specify where i want to save my log file and if so how? cus i cant seem to find it. or do u suggest uninstalling the program and reinstaling it? thanks in advance

Niels · March 2008

Dear chi-chi

You can speed up your pc performance by disabling unecessary startup items. You can do it by using the windows build in tools. You can find some startup items when you do this go to start,run,now type msconfig press enter. Go to the latest tab which is called start up (boot). There you will find some of the programs that start together with windows. To see if an item is really necessary you can enter the processname on this website. Just enter the name that you will find under the item for startup (boot) in the msconfig utility into the search box of the link I gave to you. Check also start,(all) programs,startup (boot). And the registry go to start,run,type regedit press enter. Open the following registry key hkey_local_machine and the following folders and subfolders: software,microsoft,windows,currentversion,run the startup items are being displayed at the right side. Here you have to delete them. Once you save another hijackthis logfile use than the save as function and choose your desired location. Is there any Trend Micro folder present? Which hijack this version do you currently have is v2.0.2 or still the older v1.99.1 ? But make also a log as Daniel suggested you to do.

A warning: You have to read the description because sometimes the location of the startup process is important to see if it's a legit one or not.

Best regards

Niels

farbar · March 2008

I want to improve the performance of my PC and wanted to post my Hijack this log to see if there where any major issues that stood out? The problem is when I hit save log file after doing a HJT scan I cant seem to find the location it is saving the log file? I tried looking to see if i change the default drive but can seem to find that either? If some on can help me with this I would appreciate it so I can post my log in this thread, thanks in advance.

chi-chi,

you can speedup your PC, if the slowness is not malware related, by following steps:

1. Empty your IE an FF cache on a regular basis.

2. Empty all the Temp folders.

( both 1 and 2 with ATF cleaner you have already downloaded, or CCleaner).

3. Remove unnecessary startup items using Hijackthis, Spybot or other programs handling startup items.

4. Defragment your c drive.

3. Remove all old restore points and make a clean restore point, you know already how in the other topic.

To search for the hijackthis log:

Go to start-search-click all files and folders.

Type the name of the file (hijackthislog.txt) in the upper box and click on search.

If you can't find hijackthislog.txt you have to download and install the hijackthis installer, you already know how.

farbar · March 2008

The name of the file is hijacktis.log. And if you have installed it correctly it should be here: C:\program files\trend micro\hijackthis\hijackthis.log

If not uninstall it and reinstall the hijackthis installer.

Unknown · March 2008

Please download this http://students.info.uaic.ro/~daniel.chipi...BDAspySetup.exe and install it. Then you can make a decent startup list from the "SysLog" tab. The path to the log is mentioned in the "Path to log file" textbox.

Good luck.

<<The path to the log is mentioned in the "Path to log file" textbox>>. Next to the "Browse" button you can see the path. You can use the "Browse" option to select where to save the log. Please give me the log.

chi-chi · March 2008

<<The path to the log is mentioned in the "Path to log file" textbox>>. Next to the "Browse" button you can see the path. You can use the "Browse" option to select where to save the log. Please give me the log.

How do i get you a copy of the log for this? I have the file saved. and when i hit browse to upload an attachment in this message nothing happens.

chi-chi · March 2008

The name of the file is hijacktis.log. And if you have installed it correctly it should be here: C:\program files\trend micro\hijackthis\hijackthis.log

If not uninstall it and reinstall the hijackthis installer.

I did a search for the file and windows found nothing, I also removed and re downloaded the program and still I can not fing the HJT log?? is it because of how or where I am downloading it from?

farbar · March 2008

I did a search for the file and windows found nothing, I also removed and re downloaded the program and still I can not fing the HJT log?? is it because of how or where I am downloading it from?

Please uninstall/remove your Hijackthis.

Click here to download HijackThis Installer.

Save HJTInstall.exe to your Desktop.

Double click on the HJTInstall.exe icon to start the program.

By default it will install to C:\Program Files\Trend Micro\HijackThis.

After the final dialogue box it will launch HijackThis.

Click on the Do a system scan and save a logfile button. It will scan and then open ups a log. A copy will be saved on C:\ (C:\Program Files\Trend Micro\HijackThis).

chi-chi · March 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:38:17 AM, on 3/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\WINDOWS\system32\Rundll32.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Microsoft IntelliPoint\point32 .exe

C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol .exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 212.138.64.148:8080

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe /auto

O4 - HKLM\..\Run: [bMa34f57ea] Rundll32.exe "C:\WINDOWS\system32\dnqekuhx.dll",s

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ?

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab

O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1166675633328

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1166985398326

O16 - DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} (ZPA_WheelOfFortune Object) - http://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 6870 bytes

farbar · March 2008

Hi chi-chi,

I am going to assist you to clean the infection.

It seems you have got Vundo on this computer too. And it is of no surprise to me since you are missing one important program on that computer: An antivirus.

This is somewhat suicidal in today's digital world.

You need to install an antivirus program as soon as you can and run a complete scan of the computer:

Install it, update it and then run a full scan. Let it quarantine/delete anything it finds. Let me know if there is anything that it reports but can not remove.
Copy and paste the AV scan log and a fresh HJT log into tour reply.

chi-chi · March 2008

Scan Log

Version of virus signature database: 2888 (20080220)

Date: 3/7/2008 Time: 1:44:13 PM

Scanned disks, folders and files: Operating memory;A:\Boot sector;A:\;C:\Boot sector;C:\;D:\Boot sector;D:\;E:\Boot sector;E:\;F:\Boot sector;F:\

Boot sector of disk A: - error opening [4]

A:\ - error opening [4]

C:\hiberfil.sys - error opening [4]

C:\pagefile.sys - error opening [4]

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\AIMinst.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\AIMLang.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\alsetup.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\instopts.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\muinst.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\ocpinst.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\tbsetup.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\toolbar.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\vwpt.exe » NSIS - error - unknown compression method

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4144.0.4\tbsetup.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4144.0.4\unagi3.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4144.0.4\Vwpt.exe » NSIS - error - unknown compression method

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4220.0.4\AIMinst.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4220.0.4\AIMLang.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4220.0.4\alsetup.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4220.0.4\ocpinst.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4220.0.4\tbsetup.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4220.0.4\unagi3.exe » NSIS - bad archive

C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4220.0.4\vwpt.exe » NSIS - error - unknown compression method

C:\Documents and Settings\Chief\NTUSER.DAT - error opening [4]

C:\Documents and Settings\Chief\ntuser.dat.LOG - error opening [4]

C:\Documents and Settings\Chief\Application Data\Mozilla\Firefox\Profiles\n315to4v.default\extensions\{A8F3D9BA-BB14-4f74-8272-6DE41489C89A}\chrome.manifest » MIME - is OK (internal scanning not performed)

C:\Documents and Settings\Chief\Local Settings\Application Data\Identities\{C470B9B1-8B76-4C3F-A159-9713FC3B5729}\Microsoft\Outlook Express\Inbox.dbx » DBX - is OK (internal scanning not performed)

C:\Documents and Settings\Chief\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]

C:\Documents and Settings\Chief\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]

C:\Documents and Settings\Chief\Local Settings\Temp\RCXA9.tmp - Win32/TrojanDropper.Agent.DGO virus - cleaned - quarantined

C:\Documents and Settings\Chief\Local Settings\Temp\RCXAC.tmp - Win32/TrojanDropper.Agent.DGO virus - cleaned - quarantined

C:\Documents and Settings\Chief\Local Settings\Temp\RCXAF.tmp - Win32/TrojanDropper.Agent.DGO virus - cleaned - quarantined

C:\Documents and Settings\Chief\Local Settings\Temp\TMPE9.tmp - Win32/TrojanDropper.Agent.DGO virus - internal error

C:\Documents and Settings\Chief\Local Settings\Temp\TMPF1.tmp - Win32/TrojanDropper.Agent.DGO virus - internal error

C:\Documents and Settings\Chief\Local Settings\Temp\TMPF6.tmp - Win32/TrojanDropper.Agent.DGO virus - internal error

C:\Documents and Settings\LocalService\NTUSER.DAT - error opening [4]

C:\Documents and Settings\LocalService\ntuser.dat.LOG - error opening [4]

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]

C:\Documents and Settings\NetworkService\NTUSER.DAT - error opening [4]

C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening [4]

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » PROCESS_LIBRARY.FDT » MIME - is OK (internal scanning not performed)

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » HIRING_REQUISITION_CUSTOMIZED.FDT » MIME - is OK (internal scanning not performed)

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » HARDWARE_TRACKER.FDT » MIME - is OK (internal scanning not performed)

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » HIRING_REQUISITION.FDT » MIME - is OK (internal scanning not performed)

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » CUSTOMER_SUPPORT.FDT » MIME - is OK (internal scanning not performed)

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » TRACK_ISSUES.FDT » MIME - is OK (internal scanning not performed)

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » STATUS_REPORT.FDT » MIME - is OK (internal scanning not performed)

C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\EnterWW.cab » CAB » POLICIES.FDT » MIME - is OK (internal scanning not performed)

C:\Program Files\Ahead\NeroVision\NeroFiles\CDI\CDI_VCD.CFG » MIME - is OK (internal scanning not performed)

C:\Program Files\AIM6\uninst.exe » NSIS - bad archive

C:\Program Files\AIM6\uninstall.exe » NSIS - bad archive

C:\Program Files\Common Files\Adobe\ESD\uninst.exe » NSIS - bad archive

C:\Program Files\Common Files\AOL\AOLDiag\tbunins.exe » NSIS - bad archive

C:\Program Files\Common Files\AOL\Loader\alunins.exe » NSIS - bad archive

C:\Program Files\Microsoft CAPICOM 2.1.0.2\License\license.mht » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hardware Tracker.fdt » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hiring Requisition - Customized.fdt » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hiring Requisition.fdt » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\POLICIES.FDT » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Process Library.fdt » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Status Report.fdt » MIME - is OK (internal scanning not performed)

C:\Program Files\Microsoft Office\Office12\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Track Issues.fdt » MIME - is OK (internal scanning not performed)

C:\Program Files\Mozilla Firefox\chrome\browser.manifest » MIME - is OK (internal scanning not performed)

C:\Program Files\Mozilla Firefox\chrome\comm.manifest » MIME - is OK (internal scanning not performed)

C:\Program Files\Mozilla Firefox\chrome\pippki.manifest » MIME - is OK (internal scanning not performed)

C:\Program Files\Mozilla Firefox\chrome\toolkit.manifest » MIME - is OK (internal scanning not performed)

C:\Program Files\Nero\Nero 7\Core\CDI\CDI_VCD.CFG » MIME - is OK (internal scanning not performed)

C:\Program Files\Nero\Nero 7\Nero BackItUp\BackItUp_ImageTool\root.img » GZIP » - archive damaged

C:\Program Files\Orb Networks\OrbThis extension for Firefox\OrbThis.xpi » ZIP » chrome.manifest » MIME - is OK (internal scanning not performed)

C:\Program Files\palmOne\Chief\Addit\BFUploads\UploadLog.txt » MIME - is OK (internal scanning not performed)

C:\Program Files\palmOne\Chief\Backup\Messages_Database.PDB » MIME - is OK (internal scanning not performed)

C:\Program Files\Spybot - Search & Destroy\HNMKJDYYKUQFKBSYL.scr - Win32/TrojanDropper.Agent.DGO virus - cleaned - quarantined

C:\WINDOWS\mrofinu72.exe - Win32/TrojanDownloader.Agent.BLS trojan - cleaned by deleting - quarantined [1]

C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\MSConfig .exe - Win32/TrojanDropper.Agent.DGO virus - cleaned - quarantined

C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\msconfig.exe.tmp - Win32/TrojanDropper.Agent.DGO virus - cleaned - quarantined

C:\WINDOWS\SoftwareDistribution\EventCache\{47CA60B0-FDE1-4BC7-BDE3-C7A0F88C32FE}.bin - error opening [4]

C:\WINDOWS\system32\ctfmon.exe.tmp - Win32/TrojanDropper.Agent.DGO virus - cleaned - quarantined

C:\WINDOWS\system32\L4E3A.tmp » NSIS » Yazzle1552OinAdmin.exe - probably a variant of Win32/TrojanDownloader.PurityScan trojan - was a part of the deleted object

C:\WINDOWS\system32\L6EB2.tmp » NSIS » QdrModule12.exe - Win32/Adware.ISM application - was a part of the deleted object

C:\WINDOWS\system32\CatRoot2\edb.log - error opening [4]

C:\WINDOWS\system32\CatRoot2\tmp.edb - error opening [4]

C:\WINDOWS\system32\config\default - error opening [4]

C:\WINDOWS\system32\config\default.LOG - error opening [4]

C:\WINDOWS\system32\config\SAM - error opening [4]

C:\WINDOWS\system32\config\SAM.LOG - error opening [4]

C:\WINDOWS\system32\config\SECURITY - error opening [4]

C:\WINDOWS\system32\config\SECURITY.LOG - error opening [4]

C:\WINDOWS\system32\config\software - error opening [4]

C:\WINDOWS\system32\config\software.LOG - error opening [4]

C:\WINDOWS\system32\config\system - error opening [4]

C:\WINDOWS\system32\config\system.LOG - error opening [4]

\ - error opening [4]

E:\ - error opening [4]

F:\Downloads\NOD32.3.0.642.Antivirus.Smart.Security.FiX.1.2.[31.days.remaining.forever.2

50].by.TemDono.rar » RAR » Scanner.Virus.ORG - Malware Scanning Service.mht » MIME - is OK (internal scanning not performed)

F:\Downloads\Alpha.Dog.TS.XViD-mVs-17-01-07-pass\mvs-dog-.rar » RAR » mvs-dog-.avi - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)0-=RapGodFathers.com=- Daily Updated Hip-Hop News & Downloads - Home.url - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)0-=read1st=-.txt - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)0-list-RGF.m3u - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)0-maroon_5-it_wont_be_soon_before_long-2007-RGF.nfo - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)0-Maroon_5-It_Wont_Be_Soon_Before_Long-Cover-(RapGodFathers.com).jpg - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)1-Maroon_5-If_I_Never_See_Your_Face_Again-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)2-Maroon_5-Makes_Me_Wonder-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)3-Maroon_5-Little_Of_Your_Time-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)4-Maroon_5-Wake_Up_Call-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)5-Maroon_5-Won't_Go_Home_Without_You-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)6-Maroon_5-Nothing_Lasts_Forever-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)7-Maroon_5-Can't_Stop-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)8-Maroon_5-Goodnight_Goodnight-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)9-Maroon_5-Not_Falling_Apart-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)\10-Maroon_5-Kiwi-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)\11-Maroon_5-Better_That_We_Break-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)\12-Maroon_5-Back_At_Your_Door-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\Audio\Maroon_5-It_Wont_Be_Soon_Before_Long-_RapGodFathers.com_.rar » RAR » Maroon_5-It_Wont_Be_Soon_Before_Long-(RapGodFathers.com)\13-Maroon_5-Infatuation_(Bonus_Track)-(RapGodFathers.com).mp3 - Incorrect file checksum (CRC); the file is probably password protected.

F:\Downloads\National.Treasure.2.Book.of.Secrets.TS.XviD-THS.[usaBit.com]\National.Treasure.2.Book.of.Secrets.TS.XviD-THS.part01.rar » RAR » National.Treasure.2.Book.of.Secrets.TS.XviD-THS.avi - next archive volume not found

F:\Downloads\Revolver.Directors.Cut.2005.NORDiC.PAL.DVDR-HiGHQUALiTY\hq-revolver.dc.rar » RAR » - next archive volume not found

F:\Downloads\The.Pursuit.Of.Happyness.DVD.SCREENER.XviD-VideoCD\CD1\vcd-happyness-cd1.rar » RAR » vcd-happyness-cd1.avi - next archive volume not found

F:\Downloads\The.Pursuit.Of.Happyness.DVD.SCREENER.XviD-VideoCD\CD2\vcd-happyness-cd2.rar » RAR » vcd-happyness-cd2.avi - next archive volume not found

Number of scanned objects: 166921

Number of threats found: 13

Time of completion: 3:48:25 PM Total scanning time: 7452 sec (02:04:12)

Notes:

[1] Object has been deleted as it only contained the virus body.

[4] Object cannot be opened. It may be in use by another application or operating system.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:25:20 PM, on 3/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol .exe

C:\Program Files\Microsoft IntelliPoint\point32 .exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\explorer.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 212.138.64.148:8080

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [bMa34f57ea] Rundll32.exe "C:\WINDOWS\system32\dnqekuhx.dll",s

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice