NOD32 Possible virus, need help

C

Corporal79

Gawd
Joined
Oct 28, 2004
Messages
889
I just ran NOD32 in an in depth analysis and I think I might have a virus. Here is a copy of the scanning log, I copied the potential virus and googled it but it comes back with very few hits and all the sites are in some other language. Any thoughts on how to get rid of it ?

Scan performed at: 1/5/2006 12:12:54 PM
Scanning Log
NOD32 version 1.1352 (20060104) NT
Operating memory - is OK

Date: 5.1.2006 Time: 12:12:57
Scanned disks, folders and files: C:
C:\pagefile.sys - error opening (File locked) [4]
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz1.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »errors.hpz.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »blank.htm - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz2.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz3.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz4.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz5.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz6.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz7.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz8.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz9.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz10.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz11.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz12.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz13.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz14.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz15.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz16.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz17.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz18.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz19.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\dj3740\0900a5a2802922f7\3740\Overland.cab »CAB »overland_ptce_mr_1_2.hpz20.FEE16BBD_CB2C_4E7B_AD06_10866E35C921 »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b294434fe4ac2de150f3296c490f48a8_754b9ed9-0747-4322-8285-abcc0e44ddcf - error opening (Access denied) [4]
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\de2d1c52030618e08f531c3ab2b7cc9c_754b9ed9-0747-4322-8285-abcc0e44ddcf - error opening (Access denied) [4]
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\edf13ed30f780ab74b66c6f994ec1707_754b9ed9-0747-4322-8285-abcc0e44ddcf - error opening (Access denied) [4]
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f1265865263b0e925fc8b3f738c72e5e_754b9ed9-0747-4322-8285-abcc0e44ddcf - error opening (Access denied) [4]
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f986f2468199cdce608cbf112b1f5713_754b9ed9-0747-4322-8285-abcc0e44ddcf - error opening (Access denied) [4]
C:\Documents and Settings\Carter W. Vaisey\NTUSER.DAT - error opening (File locked) [4]
C:\Documents and Settings\Carter W. Vaisey\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-6803cb76.zip »ZIP »GetAccess.class - Java/TrojanDownloader.OpenConnection.AJ trojan
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-6803cb76.zip »ZIP »Installer.class - Java/TrojanDownloader.OpenConnection trojan
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-6803cb76.zip »ZIP »NewSecurityClassLoader.class - Java/Exploit.Bytverify trojan
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-24d2cb33.zip »ZIP »javainstaller/InstallerApplet.class - Java/TrojanDownloader.OpenStream.W trojan
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv661.jar-897c2ff-5d0a0761.zip »ZIP »Matrix.class - Java/TrojanDownloader.OpenConnection trojan
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv661.jar-897c2ff-5d0a0761.zip »ZIP »Counter.class - Java/ClassLoader.H trojan
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv661.jar-897c2ff-5d0a0761.zip »ZIP »Dummy.class - Java/Dummy trojan
C:\Documents and Settings\Carter W. Vaisey\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv661.jar-897c2ff-5d0a0761.zip »ZIP »Parser.class - Java/ClassLoader.B trojan
C:\Documents and Settings\Carter W. Vaisey\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\Carter W. Vaisey\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\Carter W. Vaisey\Local Settings\Temp\GLB14E.tmp »WISE »WISE0132.DLL - error - unknown compression method
C:\Documents and Settings\Carter W. Vaisey\Local Settings\Temp\GLB158.tmp »WISE »WISE0132.DLL - error - unknown compression method
C:\Documents and Settings\Carter W. Vaisey\Local Settings\Temp\GLB17D.tmp »WISE »WISE0132.DLL - error - unknown compression method
C:\Documents and Settings\Carter W. Vaisey\Local Settings\Temp\GLB58.tmp »ZIP »WISE0001.DLL - archive damaged
C:\Documents and Settings\Carter W. Vaisey\My Documents\My Downloads\Programs\APPS-Ahead.Nero.7.Premium.Ed-www.reloaded-pharao.dl.am\n7p.rar »RAR »n7p.bin - next archive volume not found
C:\Documents and Settings\LocalService\NTUSER.DAT - error opening (File locked) [4]
C:\Documents and Settings\LocalService\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\NTUSER.DAT - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\Games\Battlefield 2\pylib-2.3.4.zip »ZIP »test/testtar.tar »TAR - archive damaged
C:\Games\Tom Clancy's Splinter Cell Chaos Theory\System\SPLINTERCELL3.EXE »GZ »l‹§(ÔwëW[}?þ¢â©ÃºÃasþ ëyÛBoçê±Õçm/bÞÛ^¡‹ª º~Å«!Çq®6ž}¬Æ“ú½?žº¤ÁûW¬éÚz<¡jçY–k<‰ËÛø¹F*¤]~ë4zŸ?1cÓpæ»V·¦ñŒb"aDšµhmûKmw
EñM=Úò ¬Ís”w_·j’+ŠŽ3'ۗ©T£mÎÀÚcSyóe.6¹â
h1"Š=™ZkÚ房-6u3_æR¡+Àš¢Èü©µeuNøë'S7w4.Úö¬)eŠŒß KV·”¿n"ð³F£³§mÏùš"¶†ä½0pu‹/!^4:+Vö˜¿JckÈÆ gñŒñ‚sð %·³au
ù«Dç†`ì$r - error - unknown compression method
C:\Program Files\HP\hpcoretech\comp\content\errors.hpz »ZIP »blank.htm - archive damaged
C:\Program Files\HP\hpcoretech\comp\content\errors.hpz.dat »ZIP »blank.htm - archive damaged
C:\Program Files\HP\hpcoretech\soln\content\overland-ptce_mr_1_2.hpz »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\Program Files\HP\hpcoretech\soln\content\overland-ptce_mr_1_2.hpz.dat »ZIP »images\fillet-small-xlight-bl.bmp - archive damaged
C:\System Volume Information\MountPointManagerRemoteDatabase - error opening (Access denied) [4]
C:\System Volume Information\_restore{978EA421-25E4-455B-AD2E-3CFEFAF115CA}\RP47\A0002461.exe »NSIS »openofficeorg4.cab »CAB »testtar.tar »TAR - archive damaged
C:\WINDOWS\system32\config\default - error opening (File locked) [4]
C:\WINDOWS\system32\config\default.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\SAM - error opening (File locked) [4]
C:\WINDOWS\system32\config\SAM.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\SECURITY - error opening (File locked) [4]
C:\WINDOWS\system32\config\SECURITY.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\software - error opening (File locked) [4]
C:\WINDOWS\system32\config\software.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\system - error opening (File locked) [4]
C:\WINDOWS\system32\config\system.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\drivers\sptd.sys - error opening (File locked) [4]
C:\WINDOWS\system32\drivers\sptd3757.sys - error opening (File locked) [4]
Number of scanned files: 291257
Number of threats found: 8
Number of active threats: 3
Time of completion: 12:56:03 Total scanning time: 2586 sec (00:43:06)

Notes:
[4] File cannot be opened. It may be in use by another application or operating system.
 
Always run your scans in safemode if they cannot be removed in normal mode. :)
 
You must log in or register to reply here.
Back
Top