This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

W32/ Delf.NAT Virus

27 min read

This thread's last reply is from August 11, 2009, 6:56 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Jiten
August 1, 2009, 6:33 PM UTC
I have a laptop which has ESET Smart Security installed on it, but it keeps flagging several files as viruses, I don't think they are viruses though. Some include googleupdaterservice.exe, stsystra.exe, WMPNetwk,exe and several more. I have run a MBAM scan already, which found two viruses, which were removed. But the alerts keep popping up. Please advise as to what to do, attached is my hijackthis log. Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:32:57, on 01/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Update ESET's licence.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - Gopher Prefix:
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--
End of file - 5663 bytes
Shaba
August 4, 2009, 5:17 AM UTC
Hi Jiten

Please post next ESET scan report :)
Jiten
August 6, 2009, 1:55 AM UTC
Hey Shaba, thanks for looking into this. The ESET Scan is below.

Scan Log
Version of virus signature database: 4296 (20090801)
Date: 01/08/2009 Time: 20:02:26
Scanned disks, folders and files: C:\
C:\pagefile.sys - error opening [4]
C:\Documents and Settings\Administrator\NTUSER.DAT - error opening [4]
C:\Documents and Settings\Administrator\ntuser.dat.LOG - error opening [4]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{EE8974F0-AEB0-4813-825D-E0917311EF26}\Microsoft\Outlook Express\Inbox.dbx » DBX - is OK (internal scanning not performed)
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]
C:\Documents and Settings\LocalService\ntuser.dat - error opening [4]
C:\Documents and Settings\LocalService\ntuser.dat.LOG - error opening [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]
C:\Documents and Settings\NetworkService\NTUSER.DAT - error opening [4]
C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening [4]
C:\Program Files\Broadcom\BACS\bacs.chm » CHM » /diags.htm - archive damaged
C:\Program Files\Broadcom\BACS\BACS.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Broadcom\BACS\BacsTray.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Common Files\System\Ole DB\sqlsoldb.chm » CHM » /Basics/coUA.css - archive damaged
C:\Program Files\Common Files\Windows Live\.cache\d5bc63fa1ca12b8\Silverlight.2.0.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwls32.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\dpinst.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\ESET\ESET Smart Security\ecls.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Intel\Intel Matrix Storage Manager\Uninstall\Lang\Storage\ESP\license.txt » MIME - is OK (internal scanning not performed)
C:\Program Files\Intel\Intel Matrix Storage Manager\Uninstall\Lang\Storage\ITA\license.txt » MIME - is OK (internal scanning not performed)
C:\Program Files\Intel\Intel Matrix Storage Manager\Uninstall\Lang\Storage\PTB\license.txt » MIME - is OK (internal scanning not performed)
C:\Program Files\Intel\Intel Matrix Storage Manager\Uninstall\Lang\Storage\PTG\license.txt » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\resources.jar » ZIP » com/sun/org/apache/xerces/internal/impl/msg/XIncludeMessages.properties » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\resources.jar » ZIP » com/sun/xml/internal/fastinfoset/resources/ResourceBundle.properties » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\resources.jar » ZIP » javax/xml/bind/Messages.properties » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\deploy\ffjcext.zip » ZIP » {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}/chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Java\jre6\lib\deploy\jqs\ff\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\Program Files\Modem Diagnostic Tool\DModem.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\setup.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\HDAQFE\win2k3\jpn\KB901105.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\HDAQFE\win2k3\us\kb901105.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stsystra.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\DellTpad.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\Media\DellTpad.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\Media\InstNT.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\Media\setup.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\Media\SynMood.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\Media\SynTPEnh.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\Media\SynZMetr.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Synaptics\SynTP\Media\Tutorial.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Windows Media Player\wmdbexport.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Windows Media Player\wmlaunch.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Windows Media Player\wmpnetwk.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\Program Files\Windows Media Player\wmsetsdk.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\ie8updates\KB972260-IE8\ie4uinit.exe.000 - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\3.5.30729\Chrome_manifest.3643236F_FC70_11D3_A536_0090278A1BB8 » MIME - is OK (internal scanning not performed)
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SetRegNI.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ToGac.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v3.5\csc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v3.5\WFServicesReg.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.cab » CAB » Chrome_manifest.3643236F_FC70_11D3_A536_0090278A1BB8 » MIME - is OK (internal scanning not performed)
C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome.manifest » MIME - is OK (internal scanning not performed)
C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\MicrosoftDotNetFrameworkAssistant.xpi » ZIP » chrome.manifest » MIME - is OK (internal scanning not performed)
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\WgaTray.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\winfxdocobj.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\wudfhost.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\config\default - error opening [4]
C:\WINDOWS\system32\config\default.LOG - error opening [4]
C:\WINDOWS\system32\config\SAM - error opening [4]
C:\WINDOWS\system32\config\SAM.LOG - error opening [4]
C:\WINDOWS\system32\config\SECURITY - error opening [4]
C:\WINDOWS\system32\config\SECURITY.LOG - error opening [4]
C:\WINDOWS\system32\config\software - error opening [4]
C:\WINDOWS\system32\config\software.LOG - error opening [4]
C:\WINDOWS\system32\config\system - error opening [4]
C:\WINDOWS\system32\config\system.LOG - error opening [4]
C:\WINDOWS\system32\dllcache\bootcfg.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\calc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\cfgwiz.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\cintsetp.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\clipbrd.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\cmd.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\conf.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\dfrgntfs.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\dialer.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\diskpart.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\dmadmin.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\dwwin.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\dxdiag.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\eudcedit.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\explorer.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\fp98swin.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\fpcount.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\fxsclnt.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\fxscover.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\fxssvc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\gprslt.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\helpctr.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\helpsvc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\icwconn1.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\iexplore.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\iexpress.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imapi.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imepadsv.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imjpdct.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imjpdsvr.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imjpinst.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imjpmig.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imjprw.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\imjputy.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\logagent.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\logon.scr - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\migrate.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\migwiz.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\migwiza.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\mmc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\mobsync.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\moviemk.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\mplay32.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\mqtgsvc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\msconfig.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\mshearts.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\mspaint.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\mtstocom.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\napstat.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\net1.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\netsetup.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\ntbackup.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\nwscript.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\osk.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\pinball.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\printfilterpipelinesvc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\progman.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\regedit.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\rsnotify.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\sctasks.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\services.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\setup_wm.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\smi2smir.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\sndrec32.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\sndvol32.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\spider.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\ss3dfo.scr - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\ssflwbox.scr - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\sspipes.scr - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\sstext3d.scr - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\sysocmgr.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\taskmgr.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\tintsetp.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\tourstrt.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\tourW.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\tracerpt.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\vssvc.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\wbemtest.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\WgaTray.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\wiaacmgr.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\winlogon.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\winmine.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\wmiadap.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\wmiapsrv.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\wmic.exe - Win32/Delf.NAP virus - deleted - quarantined
C:\WINDOWS\system32\dllcache\wordpad.exe - Win32/Delf.NAP virus - deleted - quarantined
Number of scanned objects: 69452
Number of threats found: 130
Number of cleaned objects: 130
Time of completion: 20:13:50 Total scanning time: 684 sec (00:11:24)

Notes:
[4] Object cannot be opened. It may be in use by another application or operating system.
Shaba
August 6, 2009, 4:08 AM UTC
That doesn't look promising as several windows own files have been infected and deleted.

Please go to Kaspersky website and perform an online antivirus scan.

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply along with a fresh HijackThis log.
Jiten
August 6, 2009, 4:55 AM UTC
Thanks. The logs are below.

Here is the Kaspersky log.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, August 6, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, August 06, 2009 05:45:25
Records in database: 2585376
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: no
Scan mail databases: no

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 24237
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 00:17:00

No malware has been detected. The scan area is clean.

The selected area was scanned.

Here is the Hijackthis log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:53:44, on 06/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Update ESET's licence.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

--
End of file - 6658 bytes
Shaba
August 6, 2009, 6:28 AM UTC
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:



5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.
Jiten
August 6, 2009, 8:04 AM UTC
Thanks. The log is below

2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
2007 Microsoft Office Suite Service Pack 2 (SP2)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Shockwave Player 11.5
Broadcom 440x 10/100 Integrated Controller
Choice Guard
Conexant HDA D330 MDC V.92 Modem
Dell Wireless WLAN Card
ESET Smart Security
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java(TM) 6 Update 15
jv16 PowerTools 2008
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.2)
MSVCRT
MSXML 4.0 SP3 Parser
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB973346)
Segoe UI
SigmaTel Audio
Synaptics Pointing Device Driver
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB969907)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb971933)
Update for Windows Internet Explorer 8 (KB972636)
Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
WinRAR archiver
Shaba
August 6, 2009, 8:30 AM UTC
It appears that your ESET Smart Security isn't legit. So you will need to uninstall it next.

After that, please install one free antivirus from below and post back a fresh HijackThis log.

Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:

1) Antivir PersonalEdition Classic- Free anti-virus software for Windows. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

You should run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and results in program conflicts and false virus alerts.
Jiten
August 6, 2009, 8:58 AM UTC
Thanks. I wasn't aware that ESET was not legit. Anyways, as instructed, I have uninstalled ESET and installed Avira. The Hijackthis log is below.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:56:50, on 06/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
c:\program files\avira\antivir desktop\avcenter.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

--
End of file - 6673 bytes
Shaba
August 6, 2009, 9:15 AM UTC
Please see next here how to use sfc /scannow.

After that, please check if all files marked as Win32/Delf.NAP virus in ESET scan report exist.
Jiten
August 6, 2009, 2:19 PM UTC
Hi. I've checked all the files from the ESET Scan. The majority are back, only the ones below are missing. Thanks.

C:\Program Files\Broadcom\BACS\bacs.chm » CHM » /diags.htm
C:\Program Files\Broadcom\BACS\BACS.exe
C:\Program Files\Broadcom\BACS\BacsTray.exe
C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Common Files\Windows Live\.cache\d5bc63fa1ca12b8\Silverlight.2.0.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwls32.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe
C:\Program Files\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\dpinst.exe
C:\Program Files\ESET\ESET Smart Security\ecls.exe
C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe
C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe
C:\Program Files\Modem Diagnostic Tool\DModem.exe
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\setup.exe
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\HDAQFE\win2k3\jpn\KB901105.exe
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\HDAQFE\win2k3\us\kb901105.exe
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stsystra.exe
C:\Program Files\Synaptics\SynTP\DellTpad.exe
C:\Program Files\Synaptics\SynTP\Media\DellTpad.exe
C:\Program Files\Synaptics\SynTP\Media\InstNT.exe
C:\Program Files\Synaptics\SynTP\Media\setup.exe
C:\Program Files\Synaptics\SynTP\Media\SynMood.exe
C:\Program Files\Synaptics\SynTP\Media\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\Media\SynZMetr.exe
C:\Program Files\Synaptics\SynTP\Media\Tutorial.exe
C:\Program Files\Windows Media Player\wmdbexport.exe
C:\Program Files\Windows Media Player\wmlaunch.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Media Player\wmsetsdk.exe
C:\WINDOWS\ie8updates\KB972260-IE8\ie4uinit.exe.000
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SetRegNI.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ToGac.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.5\csc.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
C:\WINDOWS\system32\winfxdocobj.exe
C:\WINDOWS\system32\wudfhost.exe
C:\WINDOWS\system32\dllcache\printfilterpipelinesvc.exe
Shaba
August 6, 2009, 2:49 PM UTC
This one missing is natural as you don't have eset anymore:

C:\Program Files\ESET\ESET Smart Security\ecls.exe

You might need to reinstall these:

Dell Wireless WLAN Card
Modem Diagnostic Tool
Synaptics
Windows Media Player

Do you have cd/dvds for three first ones?
Jiten
August 6, 2009, 2:53 PM UTC
Hey.

No I don't have the CD/DVD's, I would install it via Dell Drivers Support page. Apart from the software reinstallation, is the computer clean in terms of malware/ viruses?
Shaba
August 6, 2009, 2:56 PM UTC
Yes we can assume so if you don't have any symptoms left?
Jiten
August 6, 2009, 3:02 PM UTC
Well I've had to alerts, and Avira hasn't picked up anything either. Laptop seems to running fine. A quick Question though, for those files that I didn't find, not the program files as I will reinstall the programs, but in terms of the few missing files listed, will the latop continue to work without needing those files maybe in the future?