Spam Email from myself

Question

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:14:25 PM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\eMail ID\OEAddOn\OEdmn_3.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5071202
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hallenergyconsulting.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5071202
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IconixBHOClass Class - {761233B6-F228-49E4-8F6B-668499D4E55A} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_29.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: TwcToolbarBhoApp Class - {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\WINDOWS\system32\TwcToolbarBho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [IconixOEAddOn] "C:\Program Files\eMail ID\OEAddOn\OEdmn_3.exe"
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: (no name) - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_29.dll
O9 - Extra 'Tools' menuitem: Email ID Preferences - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_29.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_29.dll
O9 - Extra 'Tools' menuitem: About Email ID - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_29.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://prerelease.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197039806093
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 11320 bytes

I have recently gotten spam email from my own email address. I’m concerned that I have been hacked.

Thanks for any insight or help you can provide.

bamajim · Answer

N2Energy

It may just be a bot hit. Not much showing up in your log.

Run an online virus scan called Kaspersky from HERE.

1. Click on " Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on " Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on " Next"->>" Scan Settings", and make sure the database is set to " extended". And check both the scan options. Then click OK.
5. Then click on " My Computer". And the scan will start.
6. When the scan is complete Select "Save error report as"
Then in the file name just type in kaspersky
Under "save as type" select text .txt
Save it to your Desktop.

Copy and post the results of the Kaspersky Online scan

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

N2Energy · Answer

Here are the results from the scan.   ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, February 25, 2008 12:44:13 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 25/02/2008 Kaspersky Anti-Virus database records: 580051------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 78878 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 00:54:16 Infected Object Name / Virus Name / Last ActionC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\SupportSoft\DellSupportCenter\SYSTEM\state\logs\sprtcmd.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Trend Micro\PC-cillin\log\pcc_S-1-5-21-1089495191-254131004-2238994286-500.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Trend Micro\PC-cillin\log\TmPfw_S-1-5-21-1089495191-254131004-2238994286-500.log Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\GTek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\GTek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\Microsoft\Outlook\Outlook.NK2 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\Microsoft\Outlook\Outlook.srs Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\Microsoft\Templates\Normal.dot Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\Microsoft\Word\AutoRecovery save of Normal.as$ Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\Roxio\MediaManager9\Album.ldb Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\Roxio\MediaManager9\Album.psod Object is locked skippedC:\Documents and Settings\Kenneth Hall\Application Data\Sun\Java\Deployment\log\plugin150_06.trace Object is locked skippedC:\Documents and Settings\Kenneth Hall\Cookies\index.dat Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Application Data\SupportSoft\DellSupportCenter\Kenneth Hall\state\logs\sprtcmd.log Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\History\History.IE5\index.dat Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\History\History.IE5\MSHist012008022120080222\index.dat Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\hpodvd09.log Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\hsperfdata_Kenneth Hall\3080 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\JET658F.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\JET732B.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx10 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx11 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx2 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx3 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx4 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx5 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx6 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx7 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx8 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\xx9 Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~DF1260.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~DF3B7C.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~DF3B89.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~DF6832.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~DF76BF.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~DF8063.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~DFA2C1.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temp\~ROMFN_0000031C Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temporary Internet Files\Content.Word\~WRC0005.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temporary Internet Files\Content.Word\~WRD3135.doc Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temporary Internet Files\Content.Word\~WRF2225.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\Local Settings\Temporary Internet Files\Content.Word\~WRS0004.tmp Object is locked skippedC:\Documents and Settings\Kenneth Hall\My Documents\My Money(1).lrd Object is locked skippedC:\Documents and Settings\Kenneth Hall\My Documents\My Money(1).mny Object is locked skippedC:\Documents and Settings\Kenneth Hall
tuser.dat Object is locked skippedC:\Documents and Settings\Kenneth Hall
tuser.dat.LOG Object is locked skippedC:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService
tuser.dat Object is locked skippedC:\Documents and Settings\LocalService
tuser.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\NetworkService
tuser.dat.LOG Object is locked skippedC:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skippedC:\WINDOWS\Debug\PASSWD.LOG Object is locked skippedC:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{52F54EA9-D30C-41B6-9709-759284D6F529}.crmlog Object is locked skippedC:\WINDOWS\SchedLgU.Txt Object is locked skippedC:\WINDOWS\SoftwareDistribution\EventCache\{0FF46A23-53D4-4DDA-8F78-C28A0C941BA8}.bin Object is locked skippedC:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skippedC:\WINDOWS\Sti_Trace.log Object is locked skippedC:\WINDOWS\system32\CatRoot2\edb.log Object is locked skippedC:\WINDOWS\system32\CatRoot2	mp.edb Object is locked skippedC:\WINDOWS\system32\config\AppEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\DEFAULT Object is locked skippedC:\WINDOWS\system32\config\default.LOG Object is locked skippedC:\WINDOWS\system32\config\Internet.evt Object is locked skippedC:\WINDOWS\system32\config\SAM Object is locked skippedC:\WINDOWS\system32\config\SAM.LOG Object is locked skippedC:\WINDOWS\system32\config\SecEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\SECURITY Object is locked skippedC:\WINDOWS\system32\config\SECURITY.LOG Object is locked skippedC:\WINDOWS\system32\config\SOFTWARE Object is locked skippedC:\WINDOWS\system32\config\software.LOG Object is locked skippedC:\WINDOWS\system32\config\SysEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\SYSTEM Object is locked skippedC:\WINDOWS\system32\config\system.LOG Object is locked skippedC:\WINDOWS\system32\h323log.txt Object is locked skippedC:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skippedC:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skippedC:\WINDOWS\Temp\JETE516.tmp Object is locked skippedC:\WINDOWS\wiadebug.log Object is locked skippedC:\WINDOWS\wiaservc.log Object is locked skippedC:\WINDOWS\WindowsUpdate.log Object is locked skippedF:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed.

bamajim · Answer

N2Energy

I still don't see any signs of infection on this PC. As a precaution I would empty the Deleted items folder in your mailbox, and any other messages email messages that you don't need.

And:
*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!

Download CCleaner from here to clean temp files from your computer.

Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location. Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
Click on the "Options" icon at the left side of the window, then click on "Advanced." deselect "Only delete files in Windows Temp folders older than 48 hours."
Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

bamajim · Answer

N2Energy

No need to post the results of the CCleaner log.

You may want to read this article" So how did I get infected in the first place" by Tony Klein

surf safe

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

N2Energy · Answer

OK, I have run CCleaner.  Did you want to see what it found?  Is there anything else I should do? Thanks for the help.

Virus & Spyware

Spam Email from myself

Was this post helpful?