# This operation has been cancelled due to restrictions in effect on this computer.



## neelam (Sep 20, 2007)

Hello 

There is no control panel listed in start menu .No add and remove programs. When i try to adjust the clock it reads "This operation has been cancelled due to restrictions in effect on this computer.Please contact your system administrator." This warning comes to times on the screen.When i try to browse internet properties it again reads the same.

Please take note of my problem and kindly help.


Thanks in advance.


----------



## Goku (May 17, 2007)

*Welcome to TSG neelam* 

The Microsoft Knowledge Base has something relevant to your issue. Have a look.

*Error Message: This Operation Has Been Cancelled Due to Restrictions in Effect on This Computer*

Hope that helps. Good Luck.:up:


----------



## neelam (Sep 20, 2007)

I went to the link given by u. But it could n't help in my case .hope u will help me .waiting for ur reply.


thanks in advance


----------



## Frank4d (Sep 10, 2006)

The combination of problems you posted usually indicates malware. Download hijackthis here:

http://www.thespykiller.co.uk/files/HJTsetup.exe

Save HJTsetup.exe to your desktop.
Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.

Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
Click Edit > Select All> Edit > Copy to copy the entire contents of the log.
Paste the log in your next reply.

DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required. Please wait for a qualified malware expert to assist you with your log.


----------



## neelam (Sep 20, 2007)

I never knew that people like you are also present in this world who are so eager to help those in need.Thanks a lot for this co-operation.
Following is the hijack file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:32:15 PM, on 9/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\medical\Desktop\graphics soft\aawservice.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Documents and Settings\medical\Desktop\graphics soft\AAWTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sify Broadband\BBClient.exe
C:\Documents and Settings\medical\Desktop\graphics soft\DesktopAssistant\DA.exe
C:\Program Files\1-Click Answers\answers.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\1-CLIC~1\agtserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sify.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: 1-Click Answers - {7754C418-F62E-44aa-B169-E719E718BCFD} - C:\PROGRA~1\1-CLIC~1\IEToolbar\AnswersToolbarU.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Documents and Settings\medical\Desktop\graphics soft\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Documents and Settings\medical\Desktop\graphics soft\AAWTray.exe
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Broadband] C:\Program Files\Sify Broadband\BBClient.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BAloud4] C:\Program Files\Texthelp Systems\Browsealoud\4.0\BAloud4.exe
O4 - HKCU\..\Run: [DA] C:\Documents and Settings\medical\Desktop\graphics soft\DesktopAssistant\DA.exe
O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Documents and Settings\medical\Desktop\graphics soft\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: 1-Click Answers.lnk = C:\Program Files\1-Click Answers\answers.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Answers... - file://C:\Program Files\1-Click Answers\Html\atiemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2EA74C8A-8894-4F2B-992B-D284D082AEC8}: NameServer = 202.144.50.4,202.144.66.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{2EA74C8A-8894-4F2B-992B-D284D082AEC8}: NameServer = 202.144.50.4,202.144.66.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{2EA74C8A-8894-4F2B-992B-D284D082AEC8}: NameServer = 202.144.50.4,202.144.66.6
O20 - AppInit_DLLs: C:\WINDOWS\system32\systems.txt
O20 - Winlogon Notify: !SASWinLogon - C:\Documents and Settings\medical\Desktop\graphics soft\SASWINLO.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Documents and Settings\medical\Desktop\graphics soft\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Indexing Helps (Indexingbox) - Unknown owner - C:\WINDOWS\system\svchest.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6441 bytes

I hope that this will sort out the problem.

Thanks in advance

Neelam


----------



## dvk01 (Dec 14, 2002)

Download  Combofix to your desktop:

* Double-click combofix.exe & follow the prompts.
* When finished, it shall produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


----------



## neelam (Sep 20, 2007)

following is the log with combofix

Hope i have followed steps correctly:

ComboFix 07-09-21.2 - "medical" 2007-09-22 23:42:53.1 - NTFSx86 
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.73 [GMT 5.5:30]
Script execution time was exceeded on script "C:\ComboFix\restore_pt.vbs".
Script execution was terminated.
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\medical\APPLIC~1\macromedia\Flash Player\#SharedObjects\8M4S5CPZ\www.broadcaster.com
C:\DOCUME~1\medical\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\medical\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\system\svchest.reg
C:\WINDOWS\system32\x64

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\Indexingbox

((((((((((((((((((((((((( Files Created from 2007-08-22 to 2007-09-22 )))))))))))))))))))))))))))))))
.

2007-09-22 23:38	51,200	--a------	C:\WINDOWS\NirCmd.exe
2007-09-22 20:30 d--------	C:\Program Files\Trend Micro
2007-09-10 23:32 d--------	C:\Program Files\Bersoft
2007-09-07 03:02 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-07 01:59 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-07 00:52 d--h-----	C:\WINDOWS\system32\GroupPolicy
2007-09-07 00:30 d--------	C:\DOCUME~1\medical\APPLIC~1\SUPERAntiSpyware.com
2007-09-06 22:36	39,424	--a------	C:\WINDOWS\system32\vtr.dll
2007-09-06 20:06 d--------	C:\WINDOWS\pss
2007-09-06 15:41	1,369	--a------	C:\WINDOWS\mozver.dat
2007-09-06 12:27	0	--a------	C:\WINDOWS\nsreg.dat
2007-09-06 12:27 d--------	C:\DOCUME~1\medical\APPLIC~1\Talkback
2007-09-05 23:18 d--------	C:\Night.At.The.Museum[2006]DvDrip[Eng]-aXXo
2007-09-05 17:41 d--------	C:\Program Files\1-Click Answers
2007-08-31 07:19 d--------	C:\Home.Of.The.Brave.DVDrip.Sticky-inc
2007-08-30 23:05 d--------	C:\Program Files\Norton Security Scan
2007-08-27 00:27 d--------	C:\Program Files\Texthelp Systems
2007-08-27 00:27 d--------	C:\Program Files\Common Files\SpeechWorks
2007-08-27 00:27 d--------	C:\DOCUME~1\medical\APPLIC~1\Texthelp Systems
2007-08-27 00:26 d--------	C:\Program Files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-22 23:51	---------	d--------	C:\DOCUME~1\medical\APPLIC~1\Broadband
2007-09-20 14:38	---------	d--------	C:\DOCUME~1\medical\APPLIC~1\Image Zone Express
2007-09-05 13:40	---------	d-a------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-31 07:15	---------	d--------	C:\Program Files\Google
2007-08-31 06:43	---------	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
2007-08-27 02:09	---------	d--------	C:\DOCUME~1\medical\APPLIC~1\Yahoo!
2007-08-27 02:09	---------	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-08-20 23:29	---------	d--------	C:\Program Files\SB
2007-08-13 14:53	---------	d--------	C:\DOCUME~1\medical\APPLIC~1\PlayFirst
2007-08-13 14:53	---------	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
2007-08-12 16:31	---------	d--------	C:\DOCUME~1\medical\APPLIC~1\Apple Computer
2007-08-10 12:42	---------	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-10 12:41	---------	d--------	C:\Program Files\Apple Software Update
2007-08-10 12:41	---------	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-10 12:14	---------	d--------	C:\Program Files\QuickTime
2007-08-07 13:58	8320	--a------	C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56	9344	--a------	C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-01 21:01	---------	d--------	C:\Program Files\G.H.O.S.T. Hunters - The Haunting of Majesty Manor
2007-07-31 21:04	---------	d--------	C:\Program Files\Birdies
2007-07-31 20:34	---------	d--------	C:\Program Files\Dream Day Honeymoon
2007-07-27 14:01	---------	d--------	C:\Program Files\BitComet
2007-07-25 21:01	---------	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-07-25 20:25	---------	d--------	C:\Program Files\Yahoo!
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-09-14 09:46]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 14:02 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-19 00:27]
"QuickTime Task"="C:\Documents and Settings\medical\Desktop\graphics soft\qttask.exe" [2007-06-29 06:24]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"AAWTray"="C:\Documents and Settings\medical\Desktop\graphics soft\AAWTray.exe" [2007-08-08 15:53]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SifyBB"="C:\Program Files\Sify Broadband\BBImpSec.exe" [2006-04-21 20:04]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:06]
"Broadband"="C:\Program Files\Sify Broadband\BBClient.exe" [2006-04-22 09:37]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-07-16 15:17]
"BAloud4"="C:\Program Files\Texthelp Systems\Browsealoud\4.0\BAloud4.exe" [2007-06-27 12:26]
"DA"="C:\Documents and Settings\medical\Desktop\graphics soft\DesktopAssistant\DA.exe" [2007-08-21 15:29]
"SUPERAntiSpyware"="C:\Documents and Settings\medical\Desktop\graphics soft\SUPERAntiSpyware.exe" []

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
1-Click Answers.lnk - C:\Program Files\1-Click Answers\answers.exe [2007-09-05 17:41:25]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Documents and Settings\medical\Desktop\graphics soft\SASSEH.DLL [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 
C:\Documents and Settings\medical\Desktop\graphics soft\SASWINLO.dll

.
Contents of the 'Scheduled Tasks' folder
"2007-09-22 05:35:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-09-21 18:30:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 03:30:00 C:\WINDOWS\Tasks\At10.job"
"2007-09-22 04:30:00 C:\WINDOWS\Tasks\At11.job"
"2007-09-22 05:30:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 06:30:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-21 07:30:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 08:30:01 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 09:30:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 10:30:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 11:30:00 C:\WINDOWS\Tasks\At18.job"
"2007-09-22 12:30:01 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-21 19:30:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 13:30:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 14:30:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 15:30:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 16:30:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 17:30:01 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-21 18:30:00 C:\WINDOWS\Tasks\At25.job"
"2007-09-21 19:30:00 C:\WINDOWS\Tasks\At26.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-21 20:30:00 C:\WINDOWS\Tasks\At27.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-21 21:30:00 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-21 22:30:00 C:\WINDOWS\Tasks\At29.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-21 20:30:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-21 23:30:00 C:\WINDOWS\Tasks\At30.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 00:30:00 C:\WINDOWS\Tasks\At31.job"
"2007-09-22 01:30:00 C:\WINDOWS\Tasks\At32.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 02:30:00 C:\WINDOWS\Tasks\At33.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 03:30:00 C:\WINDOWS\Tasks\At34.job"
"2007-09-22 04:30:00 C:\WINDOWS\Tasks\At35.job"
"2007-09-22 05:30:00 C:\WINDOWS\Tasks\At36.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 06:30:00 C:\WINDOWS\Tasks\At37.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-21 07:30:00 C:\WINDOWS\Tasks\At38.job"
"2007-09-22 08:30:02 C:\WINDOWS\Tasks\At39.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-21 21:30:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 09:30:00 C:\WINDOWS\Tasks\At40.job"
"2007-09-22 10:30:00 C:\WINDOWS\Tasks\At41.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 11:30:00 C:\WINDOWS\Tasks\At42.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 12:30:01 C:\WINDOWS\Tasks\At43.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 13:30:00 C:\WINDOWS\Tasks\At44.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 14:30:00 C:\WINDOWS\Tasks\At45.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 15:30:00 C:\WINDOWS\Tasks\At46.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 16:30:00 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-22 17:30:01 C:\WINDOWS\Tasks\At48.job"
- C:\WINDOWS\system32\5ovUKAEL.exe
"2007-09-21 18:30:00 C:\WINDOWS\Tasks\At49.job"
"2007-09-21 22:30:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-21 19:30:00 C:\WINDOWS\Tasks\At50.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-21 20:30:00 C:\WINDOWS\Tasks\At51.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-21 21:30:00 C:\WINDOWS\Tasks\At52.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-21 22:30:00 C:\WINDOWS\Tasks\At53.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-21 23:30:00 C:\WINDOWS\Tasks\At54.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 00:30:00 C:\WINDOWS\Tasks\At55.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 01:30:00 C:\WINDOWS\Tasks\At56.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 02:30:00 C:\WINDOWS\Tasks\At57.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 03:30:00 C:\WINDOWS\Tasks\At58.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 04:30:00 C:\WINDOWS\Tasks\At59.job"
"2007-09-21 23:30:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 05:30:00 C:\WINDOWS\Tasks\At60.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 06:30:00 C:\WINDOWS\Tasks\At61.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-21 07:30:00 C:\WINDOWS\Tasks\At62.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 08:30:02 C:\WINDOWS\Tasks\At63.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 09:30:00 C:\WINDOWS\Tasks\At64.job"
"2007-09-22 10:30:00 C:\WINDOWS\Tasks\At65.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 11:30:00 C:\WINDOWS\Tasks\At66.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 12:30:01 C:\WINDOWS\Tasks\At67.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 13:30:00 C:\WINDOWS\Tasks\At68.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 14:30:00 C:\WINDOWS\Tasks\At69.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 00:30:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 15:30:00 C:\WINDOWS\Tasks\At70.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 16:30:00 C:\WINDOWS\Tasks\At71.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 17:30:01 C:\WINDOWS\Tasks\At72.job"
- C:\WINDOWS\system32\3MA4D8tA.exe
"2007-09-22 01:30:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-22 02:30:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\6t41YL2D.exe
"2007-09-14 09:30:01 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-22 23:50:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-09-22 23:54:03 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-22 23:53
.
--- E O F ---

Thanks in advance

NEELAM


----------

