Hi,
New here. My last 2 avast scans show Trojan virus present. I need assistance getting rid of them please.
I was going to include a list of the anti spyware programs I use but I don't know how to insert the .bmp image of that folder. Is that possible here? I run them on a fairly regular basis ( but apparently not often enough) mainly CCleaner, AdAware,Spybot, recently added Malwarebyte. Oh I think I figured it outhow to upload .bmp.
Thanks in advance for any assistance
JBBIGQ
From Sept 11 08
C:\WINDOWS\TrueProcess.exe [L] Win32:Trojan-gen {Other} (0)
from Sept 18 08
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\ RP572\A0065120.exe [L] Win32:Trojan-gen {Other} (0)
Does this mean the virus is embedded in the restore point and not working unless I activate it??? Is it the same one from 9/11/08?
Anyway here is my info HiJack this list to follow.
System Configuration Summary
================================================
Operating System Windows XP (5.01.2600)
Internet Explorer 7.00.5730.0011
MSN Client 9.50.0039.1900
MSN Market en-us
MSN Brand MSN [Q002]
MSN SKU Qwest Choice DSL with MSN
Default E-mail Program MSN Explorer
Amount of Memory 0.99 GB
Free Disk Space C: 80.1 GB, D: 20.9 GB
Component versions
================================================
msn.exe 9.50.0039.1900
msnmetal.dll 9.50.0039.1900
msnmtllc.dll 9.50.0039.1900
msdbx.dll 9.50.0039.1900
msnap.dat 9.05.6001.0001
msnap.dll 1.00.4611.0000
sqdll.dll 12.2002.1126.0001
update.exe 9.50.0039.1900
shdocvw.dll 6.00.2900.5512
qmgr.dll 6.07.2600.5512
dw15.exe 10.00.4413.0000
dwintl.dll 10.00.2625.0000
canvas.dll 2.00.0420.0000
connectr.dll 2.00.0420.0000
logonmgr.exe 2.00.0420.0000
msncc.exe 2.00.0420.0000
msnccore.dll 2.00.0420.0000
slhelper.dll 2.00.0420.0000
msninst.exe 9.50.0485.0000
msninst.dll 9.50.0485.0000
msnsign.dll 9.50.0485.0000
market.mar 9.2007.0320.01
brand.mar 9.50.0000.0000
Windows Media Player 11.00.5721.5145
Windows Live Messenger 8.01.0178.0000
Macromedia Flash 9.00.0124.0000
SQLLite Versions
================================================
jbbigq@msn.com 2.0
jblvswmn@msn.com 2.0
jdbigq@msn.com 2.0
mchughspools@msn.com 2.0
pgbook@msn.com 2.0
Network drivers
================================================
Intel® PRO/100 VE Network Connection (8.0.15.0)
e100b325.sys (8.00.0015.0000)
WAN Miniport (L2TP) (5.1.2535.0)
rasl2tp.sys (5.01.2600.5512)
WAN Miniport (IP) (5.1.2535.0)
ndiswan.sys (5.01.2600.5512)
WAN Miniport (PPPOE) (5.1.2535.0)
raspppoe.sys (5.01.2600.5512)
WAN Miniport (PPTP) (5.1.2535.0)
raspptp.sys (5.01.2600.5512)
Packet Scheduler Miniport (5.1.2535.0)
psched.sys (5.01.2600.5512)
Packet Scheduler Miniport (5.1.2535.0)
psched.sys (5.01.2600.5512)
Direct Parallel (5.1.2535.0)
raspti.sys (5.01.2600.0000)
WAN Miniport (ATW) (8.3.0.0)
wanatw4.sys (8.03.0000.0000)
Modem drivers
================================================
Conexant D850 56K V.9x DFVc Modem (7.6.0.50)
Modem.sys (5.01.2600.5512)
Auto-update status
================================================
Previous version: 9.20.0026.0800
Next version: (none)
Avast log from 9/11/08
Date/Time File/Object Status
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar10.zip\sbRecovery.reg [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar10.zip\sbRecovery.ini [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar12.zip\sbRecovery.reg [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar12.zip\sbRecovery.ini [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar13.zip\sbRecovery.reg [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar13.zip\sbRecovery.ini [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar7.zip\sbRecovery.reg [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar7.zip\sbRecovery.ini [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar8.zip\sbRecovery.reg [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar8.zip\sbRecovery.ini [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar9.zip\sbRecovery.reg [E] Archive is password protected. (42056)
1:17:51 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar9.zip\sbRecovery.ini [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-07-2008 - 17-08-11.SBU\ {83755133-B8A0-42A4-B62C-34DAB26C06B9} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-07-2008 - 17-08-11.SBU\ backup.db [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {09EA09E0-5D23-4125-A06A-C62CABBBF53E} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {0CB03655-2226-4E17-9EBE-8B617F1EA69E} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {2916C2B7-94B5-48C4-8A21-D7049C52CEAC} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {350CBC9F-44E6-4484-A3AC-70113A4E085E} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {37DF7913-315C-495C-A09E-7758D7445178} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {3A0F5B87-B70E-475D-B4C3-5FCBD201570A} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {3B5E9F9C-6336-44DC-B00A-15B53651ADB7} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {3D91C01C-BB3E-4FB5-98AD-DE56FF1A834B} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {438407BA-0B53-477B-A31D-805F97C6E887} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {5769BD92-A8EF-412C-BB0F-4439CEFC1D88} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {5A227DCC-903B-4CAF-981B-97F8D72F41B5} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {5B0E9AE3-E31F-409A-9CEA-225D09C66A73} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {62D4696A-2A22-4B01-BEA3-7146B18D9393} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {630E1AA3-416E-4239-B8E6-B80CAF10DB94} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {6BFA56FB-9457-44DC-9245-3D53AB1D8281} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {8F891942-BBC5-4BB5-A7C8-F1C898951E81} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {8FF41770-27D6-486D-B317-F8A690495C29} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {94F85B7E-B14A-4C99-9812-98A24C2EC721} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {97D40B8C-1813-4B44-96A7-658C3197104D} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9864EF92-2B52-4FED-AF82-542D315B2642} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9ADE2422-C683-4A80-8A0F-92454B29E43A} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9D828168-FD5D-41DA-A6AE-2C6F0E4E9CEE} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9DD56F1E-6583-42EE-8C44-54255452F84C} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9FAA42C0-4AD6-4C09-9364-DE53BE79190F} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {A439A7B5-162E-44F9-8382-BBE7081BDA22} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B1978428-04F7-487D-B5E0-ECDAFD0D29F4} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B5279829-B184-4C68-BD8E-FB5E946D2AA7} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B609DC89-FA53-42A7-8D24-9D7577FBC474} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B9CDBDF4-DFD6-4C31-84D8-38285FD37ADB} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {D7E34B34-3524-421C-8191-5DCFF4362A65} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {D7FB6128-B43C-4D5A-9392-2511DA1B9D11} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {DB7F004D-DB9F-48EB-9792-59145C4BB7A8} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {E610D27B-5D63-4662-BC3A-1D65F80043FB} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ backup.db [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {0731C643-98E9-411B-9AA6-D38C4558BFC7} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {15B9ACEF-DEE2-43FD-B34D-876681DFED12} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {18E7E417-16C5-43F1-A43B-9872F1DA49E2} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {1A3043C0-A2D5-4F86-AE92-29E2CA23DA46} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {1BDCC9D3-BF3A-468E-A3C9-BD5BFED8D8C5} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {20FAD23C-B063-4E8B-95C7-61950DB5344C} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {4273D780-8FF9-4386-866C-C50355226F46} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {49451611-A7C3-4FA9-B9E7-D8C0C5372AC3} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {5FD286B1-9F3A-4FDE-BD3B-CCE918B3D144} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {69BBD0A3-FEA8-4D53-9965-07FFAACA538A} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {720953E8-C0C2-448A-B221-4887C760256D} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {7CBB4997-01C3-491E-83DF-2AA8FC111504} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {86870291-E0B9-4E2C-AB2D-C060C58625AB} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {92B7D29B-5E19-4197-B4EB-88C3B9AAC5B6} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {A81F8872-A736-4849-BFAA-4E19C270BAEF} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {AC168EF9-2090-4BE7-8430-E649A5F29170} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {C30F8E12-EB19-426F-9E8A-690890473A56} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {C5C97343-A661-4614-94C4-979DFE20753B} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {CCCAA6C0-ABF9-4DAC-8F9D-7E1331A9C1CF} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {CFAC06E7-E14E-45CA-9A34-F9E965766FEC} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {DFE02BAC-F3EE-4925-B3C0-63C66F059997} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {EA40B7BF-D4BF-40AB-B309-340BA7D227AE} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {F6DDCEF4-5290-4159-B9C1-899A006C9755} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {F881C65B-E44A-486B-A156-21304806A094} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {FD37A9C1-F810-4920-8B56-2085446F6145} [E] Archive is password protected. (42056)
1:22:46 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ backup.db [E] Archive is password protected. (42056)
1:56:59 AM C:\Documents and Settings\Jim\Local Settings\Application Data\Microsoft\ Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
1:56:59 AM C:\Documents and Settings\Jim\Local Settings\Application Data\Microsoft\ Windows\UsrClass.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
2:14:14 AM C:\Documents and Settings\Jim\ntuser.dat [E] The process cannot access the file because it is being used by another process (32)
2:14:14 AM C:\Documents and Settings\Jim\ntuser.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
2:14:17 AM C:\Documents and Settings\LocalService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
2:14:17 AM C:\Documents and Settings\LocalService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
2:14:18 AM C:\Documents and Settings\LocalService\NTUSER.DAT [E] The process cannot access the file because it is being used by another process (32)
2:14:18 AM C:\Documents and Settings\LocalService\ntuser.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
2:14:18 AM C:\Documents and Settings\NetworkService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
2:14:18 AM C:\Documents and Settings\NetworkService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
2:14:18 AM C:\Documents and Settings\NetworkService\NTUSER.DAT [E] The process cannot access the file because it is being used by another process (32)
2:14:18 AM C:\Documents and Settings\NetworkService\ntuser.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
2:14:24 AM C:\hiberfil.sys [E] The process cannot access the file because it is being used by another process (32)
2:22:12 AM C:\pagefile.sys [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\DEFAULT [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\default.LOG [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\SAM [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\SAM.LOG [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\SECURITY [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\SECURITY.LOG [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\SOFTWARE [E] The process cannot access the file because it is being used by another process (32)
3:21:01 AM C:\WINDOWS\system32\config\software.LOG [E] The process cannot access the file because it is being used by another process (32)
3:21:04 AM C:\WINDOWS\system32\config\SYSTEM [E] The process cannot access the file because it is being used by another process (32)
3:21:04 AM C:\WINDOWS\system32\config\system.LOG [E] The process cannot access the file because it is being used by another process (32)
3:24:57 AM C:\WINDOWS\temp\Perflib_Perfdata_580.dat [E] The process cannot access the file because it is being used by another process (32)
3:24:57 AM C:\WINDOWS\temp\_avast4_\Webshlock.txt [E] The process cannot access the file because it is being used by another process (32)
3:24:58 AM C:\WINDOWS\TrueProcess.exe [L] Win32:Trojan-gen {Other} (0)
Start of testing: Thursday, September 11, 2008
Avast log 9/18/08
Avast Anti virus
Start of testing: Thursday, September 18, 2008 12:40:31 AM
End of testing: Thursday, September 18, 2008 7:37:12 AM
Virus Database:
Date/Time File/Object Status
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar10.zip\sbRecovery.reg [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar10.zip\sbRecovery.ini [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar12.zip\sbRecovery.reg [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar12.zip\sbRecovery.ini [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar13.zip\sbRecovery.reg [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar13.zip\sbRecovery.ini [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar7.zip\sbRecovery.reg [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar7.zip\sbRecovery.ini [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar8.zip\sbRecovery.reg [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar8.zip\sbRecovery.ini [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar9.zip\sbRecovery.reg [E] Archive is password protected. (42056)
12:42:58 AM C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ Recovery\CouponBar9.zip\sbRecovery.ini [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-07-2008 - 17-08-11.SBU\ {83755133-B8A0-42A4-B62C-34DAB26C06B9} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-07-2008 - 17-08-11.SBU\ backup.db [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {09EA09E0-5D23-4125-A06A-C62CABBBF53E} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {0CB03655-2226-4E17-9EBE-8B617F1EA69E} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {2916C2B7-94B5-48C4-8A21-D7049C52CEAC} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {350CBC9F-44E6-4484-A3AC-70113A4E085E} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {37DF7913-315C-495C-A09E-7758D7445178} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {3A0F5B87-B70E-475D-B4C3-5FCBD201570A} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {3B5E9F9C-6336-44DC-B00A-15B53651ADB7} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {3D91C01C-BB3E-4FB5-98AD-DE56FF1A834B} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {438407BA-0B53-477B-A31D-805F97C6E887} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {5769BD92-A8EF-412C-BB0F-4439CEFC1D88} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {5A227DCC-903B-4CAF-981B-97F8D72F41B5} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {5B0E9AE3-E31F-409A-9CEA-225D09C66A73} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {62D4696A-2A22-4B01-BEA3-7146B18D9393} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {630E1AA3-416E-4239-B8E6-B80CAF10DB94} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {6BFA56FB-9457-44DC-9245-3D53AB1D8281} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {8F891942-BBC5-4BB5-A7C8-F1C898951E81} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {8FF41770-27D6-486D-B317-F8A690495C29} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {94F85B7E-B14A-4C99-9812-98A24C2EC721} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {97D40B8C-1813-4B44-96A7-658C3197104D} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9864EF92-2B52-4FED-AF82-542D315B2642} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9ADE2422-C683-4A80-8A0F-92454B29E43A} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9D828168-FD5D-41DA-A6AE-2C6F0E4E9CEE} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9DD56F1E-6583-42EE-8C44-54255452F84C} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {9FAA42C0-4AD6-4C09-9364-DE53BE79190F} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {A439A7B5-162E-44F9-8382-BBE7081BDA22} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B1978428-04F7-487D-B5E0-ECDAFD0D29F4} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B5279829-B184-4C68-BD8E-FB5E946D2AA7} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B609DC89-FA53-42A7-8D24-9D7577FBC474} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {B9CDBDF4-DFD6-4C31-84D8-38285FD37ADB} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {D7E34B34-3524-421C-8191-5DCFF4362A65} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {D7FB6128-B43C-4D5A-9392-2511DA1B9D11} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {DB7F004D-DB9F-48EB-9792-59145C4BB7A8} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ {E610D27B-5D63-4662-BC3A-1D65F80043FB} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 06-20-2008 - 09-03-27.SBU\ backup.db [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {0731C643-98E9-411B-9AA6-D38C4558BFC7} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {15B9ACEF-DEE2-43FD-B34D-876681DFED12} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {18E7E417-16C5-43F1-A43B-9872F1DA49E2} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {1A3043C0-A2D5-4F86-AE92-29E2CA23DA46} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {1BDCC9D3-BF3A-468E-A3C9-BD5BFED8D8C5} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {20FAD23C-B063-4E8B-95C7-61950DB5344C} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {4273D780-8FF9-4386-866C-C50355226F46} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {49451611-A7C3-4FA9-B9E7-D8C0C5372AC3} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {5FD286B1-9F3A-4FDE-BD3B-CCE918B3D144} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {69BBD0A3-FEA8-4D53-9965-07FFAACA538A} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {720953E8-C0C2-448A-B221-4887C760256D} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {7CBB4997-01C3-491E-83DF-2AA8FC111504} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {86870291-E0B9-4E2C-AB2D-C060C58625AB} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {92B7D29B-5E19-4197-B4EB-88C3B9AAC5B6} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {A81F8872-A736-4849-BFAA-4E19C270BAEF} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {AC168EF9-2090-4BE7-8430-E649A5F29170} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {C30F8E12-EB19-426F-9E8A-690890473A56} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {C5C97343-A661-4614-94C4-979DFE20753B} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {CCCAA6C0-ABF9-4DAC-8F9D-7E1331A9C1CF} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {CFAC06E7-E14E-45CA-9A34-F9E965766FEC} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {DFE02BAC-F3EE-4925-B3C0-63C66F059997} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {EA40B7BF-D4BF-40AB-B309-340BA7D227AE} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {F6DDCEF4-5290-4159-B9C1-899A006C9755} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {F881C65B-E44A-486B-A156-21304806A094} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ {FD37A9C1-F810-4920-8B56-2085446F6145} [E] Archive is password protected. (42056)
12:47:39 AM C:\Documents and Settings\Jim\Application Data\SUPERAntiSpyware.com\ SUPERAntiSpyware\Quarantine\Quarantine - 08-24-2008 - 17-12-08.SBU\ backup.db [E] Archive is password protected. (42056)
1:20:39 AM C:\Documents and Settings\Jim\Local Settings\Application Data\Microsoft\ Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
1:20:39 AM C:\Documents and Settings\Jim\Local Settings\Application Data\Microsoft\ Windows\UsrClass.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
1:21:19 AM C:\Documents and Settings\Jim\Local Settings\Temp\tmp921.tmp [E] The process cannot access the file because it is being used by another process (32)
1:21:20 AM C:\Documents and Settings\Jim\Local Settings\Temp\~DF893F.tmp [E] The process cannot access the file because it is being used by another process (32)
1:37:33 AM C:\Documents and Settings\Jim\ntuser.dat [E] The process cannot access the file because it is being used by another process (32)
1:37:33 AM C:\Documents and Settings\Jim\ntuser.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
1:37:36 AM C:\Documents and Settings\LocalService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
1:37:36 AM C:\Documents and Settings\LocalService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
1:37:36 AM C:\Documents and Settings\LocalService\NTUSER.DAT [E] The process cannot access the file because it is being used by another process (32)
1:37:36 AM C:\Documents and Settings\LocalService\ntuser.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
1:37:36 AM C:\Documents and Settings\NetworkService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
1:37:36 AM C:\Documents and Settings\NetworkService\Local Settings\Application Data\ Microsoft\Windows\UsrClass.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
1:37:37 AM C:\Documents and Settings\NetworkService\NTUSER.DAT [E] The process cannot access the file because it is being used by another process (32)
1:37:37 AM C:\Documents and Settings\NetworkService\ntuser.dat.LOG [E] The process cannot access the file because it is being used by another process (32)
1:37:42 AM C:\hiberfil.sys [E] The process cannot access the file because it is being used by another process (32)
1:45:00 AM C:\pagefile.sys [E] The process cannot access the file because it is being used by another process (32)
2:19:27 AM C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\ RP572\A0065120.exe [L] Win32:Trojan-gen {Other} (0)
7:32:54 AM C:\WINDOWS\SoftwareDistribution\EventCache\{87F057DB-8D18-43EB-B934-A9A648AE0B52}.bin [E] The process cannot access the file because it is being used by another process (32)
7:33:12 AM C:\WINDOWS\system32\CatRoot2\edb.log [E] The process cannot access the file because it is being used by another process (32)
7:33:12 AM C:\WINDOWS\system32\CatRoot2\tmp.edb [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\DEFAULT [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\default.LOG [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\SAM [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\SAM.LOG [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\SECURITY [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\SECURITY.LOG [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\SOFTWARE [E] The process cannot access the file because it is being used by another process (32)
7:33:17 AM C:\WINDOWS\system32\config\software.LOG [E] The process cannot access the file because it is being used by another process (32)
7:33:20 AM C:\WINDOWS\system32\config\SYSTEM [E] The process cannot access the file because it is being used by another process (32)
7:33:20 AM C:\WINDOWS\system32\config\system.LOG [E] The process cannot access the file because it is being used by another process (32)
7:36:59 AM C:\WINDOWS\temp\Perflib_Perfdata_4d0.dat [E] The process cannot access the file because it is being used by another process (32)
7:36:59 AM C:\WINDOWS\temp\Perflib_Perfdata_580.dat [E] The process cannot access the file because it is being used by another process (32)
7:36:59 AM C:\WINDOWS\temp\_avast4_\Webshlock.txt [E] The process cannot access the file because it is being used by another process (32)
HJT LOG
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:51:40 AM, on 9/18/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Documents and Settings\Jim\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\PermissionTV\bin\dmtray.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LxrSII1s.exe
C:\PROGRA~1\PERMIS~1\bin\dm.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\MSN\MSNCoreFiles\MSN.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\dlbucoms.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LxrAutorun] C:\Documents and Settings\Jim\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Pima County Public Library Tray App.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1156453173265
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://poolcorp.webex.com/client/T23L/support/ieatgpc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - Unknown owner - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PermissionTV Download Manager Service (PermissionTVDownloadManager) - PermissionTV - C:\PROGRA~1\PERMIS~1\bin\dm.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
--
End of file - 9595 bytes
Full Version: 2 Instances of Trojans
2- more things
I guess the upload of the screenshot didn't work.
How long should I leave or how often should I clean out the quarentine files of Spybot Adaware etc. Am I right in thinking leaving thos file in ther just causes my antivirus program to run longer determining they are archive and not readable???
Hello JBBIGQ,
Welcome to Gladiator Security Forum
I don't see anything malicious in your HijackThis log. Are you currently having any problems?
Yes, you're correct in your reasoning. You can empty all the quarantines you have going there. After you do that, run this scanner and we'll see what might be left :
Please download Malwarebytes' Anti-Malware from one of these places:
http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html
http://www.besttechie.net/tools/mbam-setup.exe
Double Click mbam-setup.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire report in your next reply along with a fresh HijackThis log.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
Thanks,
tea
Welcome to Gladiator Security Forum
I don't see anything malicious in your HijackThis log. Are you currently having any problems?
Yes, you're correct in your reasoning. You can empty all the quarantines you have going there. After you do that, run this scanner and we'll see what might be left :
Please download Malwarebytes' Anti-Malware from one of these places:
http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html
http://www.besttechie.net/tools/mbam-setup.exe
Double Click mbam-setup.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire report in your next reply along with a fresh HijackThis log.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
Thanks,
tea
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.