HI There, (Message Part 1, Sorry Its So Long)
And Thank You In Advance Anyone !
I Have A Box Running Vista H/P 64 Bit Windows i7 CPU Etc…i Can Goive You ALL The Specs If That Would Help …
Running Avast For Home “Program 6.0.1.1289” “Virus Def Ver 111023-2”
I Scanned My Machine Like I Do Every Nite And This Came Up…Never Has Before ??
Sorry To List So Many Files, They Are “samples” Of “each Catagory” Didn’t Want To Put All 1100+ File Here …
"Infected files: 1171
Total files: 1672945
Total folders: 96917
Total size: 3.3 TB "
Scan name: Full system scan
-
Started on: Sunday, October 23, 2011 3:00:04 AM
-
VPS: 111022-1, 10/22/2011
*=====================================================
This Was Just The Night Before “Infected files: 0
Total files: 1665645
Total folders: 96872
Total size: 3.3 TB” -
Scan stopped: Saturday, October 22, 2011 12:44:18 PM
-
Run-time was 9 hour(s), 44 minute(s), 14 second(s)
======================================
PID 64128 [L] Rootkit: hidden process (0)
PID 11 [L] Rootkit: hidden process (0)
PID 64128 [L] Rootkit: hidden process (0)
PID 9 [L] Rootkit: hidden process (0)
PID 64128 [L] Rootkit: hidden process (0)
PID 11 [L] Rootkit: hidden process (0)
PID 64128 [L] Rootkit: hidden process (0)
PID 11 [L] Rootkit: hidden process (0)
PID 64128 [L] Rootkit: hidden process (0)
PID 11 [L] Rootkit: hidden process (0)
PID 64128 [L] Rootkit: hidden process (0)
PID 9 [L] Rootkit: hidden process (0)
PID 64128 [L] Rootkit: hidden process (0)
PID 11 [L] Rootkit: hidden process (0)
PID 64128 [L] Rootkit: hidden process (0)
PID 9 [L] Rootkit: hidden pr
C:\EXCEL_FILES~$OPEN_10_21_2011.xlsx [E] The process cannot access the file because it is being used by another process (32)
C:\hiberfil.sys [E] The process cannot access the file because it is being used by another process (32)
C:\pagefile.sys [E] The process cannot access the file because it is being used by another process (32)
C:\System Volume Information\ISwift3.dat [E] The process cannot access the file because it is being used by another process (32)
C:\System Volume Information{0b06c3e1-f5ef-11e0-b16f-0024e8294a9c}{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
C:\System Volume Information{0b06c3f1-f5ef-11e0-b16f-0024e8294a9c}{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
C:\System Volume Information{0b06c442-f5ef-11e0-b16f-0024e8294a9c}{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
C:\System Volume Information{0b06c451-f5ef-11e0-b16f-0024e8294a9c}{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
C:\Users\Wildwizard\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 [E] The process cannot access the file because it is being used by another process (32)
\Local\Google\Chrome\User Data\Default\Cache\data_5 [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{86380433-FB0D-11E0-A068-0024E8294A9C}.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active{01F0C3F0-FC89-11E0-A068-0024E8294A9C}.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active{0EEECE00-FC41-11E0-A068-0024E8294A9C}.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active{579FBFA0-FD46-11E0-A068-0024E8294A9C}.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active{6EEC5A10-FC88-11E0-A068-0024E8294A9C}.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Windows\UsrClass.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\AppData\Local\Temp\etilqs_3PBzf7AdZTgIIIG [E] The process cannot access the file because it is being used by another process (32)
because it is being used by another process (32)
C:\Users\Wildwizard\ntuser.dat.LOG1 [E] The process cannot access the file because it is being used by another process (32)
C:\Users\Wildwizard\ntuser.dat.LOG2 [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\enterprisesec.config.cch.17892.38909332 [E] Access is denied (5)
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\security.config.cch.17892.38909332 [E] Access is denied (5)
C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\ServiceProfiles\LocalService\ntuser.dat [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 [E] The process cannot access the file because it is being used by another process (32)
CC:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\System32\catroot2\edb.log [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\System32\catroot2{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\System32\catroot2{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\System32\config\components [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl [E] The process cannot access the file because it is being used by another process (32)
C:\Windows\Temp_avast_\Webshlock.txt [E] The process cannot access the file because it is being used by another process (32)
D:\System Volume Information{0b06c4ce-f5ef-11e0-b16f-0024e8294a9c}{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
D:\System Volume Information{fa34a6a2-fb01-11e0-b3a9-0024e8294a9c}{3808876b-c176-4e48-b7ae-04046e6cc752} [E] Access is denied (5)
O:\ [E] Skipped due to exclusions settings. (42019)
o:\storagewipe\storagewipe.exe [E] Skipped due to exclusions settings. (42019)
Infected files: 1171
Total files: 1672945
Total folders: 96917
Total size: 3.3 TB
- Scan stopped: Sunday, October 23, 2011 10:41:53 AM
- Run-time was 7 hour(s), 41 minute(s), 49 second(s)
A Total Over OVER 1100+ Files
No String Like C:.….….… For TheRootkit Files ?
I Read About Rootkit’s And Says A Total Security Breach Has Begun On My System
Ahhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh Nooooooooooooooooo
Can I Go Into DOS And Look For/And Delete Them ??
Avast Recomended A 'Delete" FOr ALL Files, I Tried That And Said FIle Could NOT Be Found…
I Did A Scan Again And Got The Same Results 
And Again Avast Said Cound Not Delete File Specified Not Found …Did This Again And Again…
I Rebooted And Scanned And There Were NO Threats Detected …
However The San Usually Starts Out “Enumerating Registery” Etc And Then Scans…
NOW It STARTS @ C:\windows\system32\lsm.exe And Continues From That Point Which I Believe Is Not Where It Usually Starts, I Could Be Wrong …
Also i Have 2 Internal HDA’s ( 1x 1TB, 1X 2TB) External Drives 5X 1TB Passports, And 1X 500GB Passport 7 Logical Drives And 6 Physical Drives ( Recovery Partion On Root Drive C:\ Is D:\
Any Chance They Are Infected ?? And I Just Cannot See It ?? 1 HDA Is For Back-ups Everyday…
Should I Do A Restore From Maybe 5-7 Days Ago
Pleaseeeeeeeeeeeeeeeeeeeeee Helppppppppppppppppp !!
Ahhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
