 Infected And Removed Bloodhound.packed.jmp Virus?, Virus Infection and Removal |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
  |
  Mar 28 2008, 07:54 PM
Post
#1
|
|
|
New Member  Group: Members Posts: 10 Joined: 28-March 08 Member No.: 199,481  |
My comptuer get infected by Bloodhound.Packed.Jmp virus, then I run Combofix and it seems deleted the virus, but I'll still post the combofix log and highjackThis log and see if any CS Pro can find any left over virus in my computer.  Thanks everyone for reading this post.Dennis  Combofix log: ComboFix 08-03-27.2 - Dennis Hsu 2008-03-29 8:33:23.2 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.950.1.1028.18.1012 [GMT 8:00] 執行位置?: C:\Documents and Settings\Dennis Hsu\桌面\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . (((((((((((((((((((((((((((((((((((((( 其他遭刪除的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\amvo1.dll D:\Autorun.inf F:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_npf (((((((((((((((((((((((((((( 2008-02-28 - 2008-03-29 之間建立的檔案 ))))))))))))))))))))))))))))))))) . 2008-03-29 16:44 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-03-29 16:43 . 2001-08-31 17:24 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-03-29 16:43 . 2001-08-31 17:24 12,160 --a------ C:\WINDOWS\system32\dllcache\mouhid.sys 2008-03-29 16:40 . 2008-03-29 16:29 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Bluetooth Software 2008-03-29 16:40 . 2008-03-29 16:06 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec 2008-03-29 16:40 . 2008-03-29 16:09 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Infineon 2008-03-29 16:40 . 2008-03-29 15:41 <DIR> d-------- C:\Documents and Settings\Dennis Hsu\桌面 2008-03-29 16:40 . 2008-03-29 16:29 <DIR> d-------- C:\Documents and Settings\Dennis Hsu\Bluetooth Software 2008-03-29 16:40 . 2008-03-29 16:06 <DIR> d-------- C:\Documents and Settings\Dennis Hsu\Application Data\Symantec 2008-03-29 16:40 . 2008-03-29 16:11 <DIR> d-------- C:\Documents and Settings\Dennis Hsu\Application Data\Intel 2008-03-29 16:40 . 2008-03-29 16:09 <DIR> d-------- C:\Documents and Settings\Dennis Hsu\Application Data\Infineon 2008-03-29 16:40 . 2008-03-29 15:41 <DIR> dr------- C:\Documents and Settings\Dennis Hsu\「開始」功能表 2008-03-29 16:40 . 2008-03-29 16:29 <DIR> d-------- C:\Documents and Settings\Default User\Bluetooth Software 2008-03-29 16:40 . 2008-03-29 16:40 546 --a------ C:\WINDOWS\system32\ABW7J.DAT 2008-03-29 16:37 . 2008-03-29 16:37 8,192 --a------ C:\WINDOWS\REGLOCS.OLD 2008-03-29 16:35 . 2008-03-29 16:35 <DIR> d--hs---- C:\Recycled 2008-03-29 16:35 . 2008-03-29 16:35 333 --a------ C:\WINDOWS\system32\$ncsp$.inf 2008-03-29 16:35 . 2008-03-29 16:35 61 --a------ C:\WINDOWS\smscfg.ini 2008-03-29 16:32 . 2008-03-29 16:32 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-03-29 16:18 . 2008-03-28 22:57 102,080 -r-hs---- C:\1weicxa.com 2008-03-29 16:13 . 2008-03-29 16:13 <DIR> d-------- C:\Program Files\WIDCOMM 2008-03-29 16:11 . 2008-03-29 16:11 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2008-03-29 16:11 . 2008-03-29 16:11 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Intel 2008-03-29 16:11 . 2008-03-29 16:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Intel 2008-03-29 16:11 . 2008-03-29 16:11 21,275 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2008-03-29 16:09 . 2008-03-29 16:09 <DIR> d-------- C:\Program Files\Infineon 2008-03-29 16:09 . 2008-03-29 16:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Infineon 2008-03-29 16:06 . 2008-03-29 16:06 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-03-29 16:06 . 2008-03-29 16:06 <DIR> d-------- C:\Program Files\Norton Internet Security 2008-03-29 16:06 . 2008-03-29 16:06 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-03-29 16:06 . 2008-03-29 16:06 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-03-29 16:05 . 2008-03-29 16:05 <DIR> d-------- C:\Program Files\Symantec 2008-03-29 16:05 . 2008-03-29 16:05 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-03-29 16:05 . 2008-03-29 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-03-29 16:05 . 2004-08-26 21:03 104,144 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-03-29 16:05 . 2004-08-26 21:03 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-03-29 16:03 . 2008-03-29 16:03 <DIR> d-------- C:\Program Files\Synaptics 2008-03-29 16:03 . 2006-01-27 04:25 191,936 --a------ C:\WINDOWS\system32\drivers\SynTP.sys 2008-03-29 16:03 . 2005-07-06 15:43 155,648 --a------ C:\WINDOWS\system32\ACEngSvr.exe 2008-03-29 16:03 . 2006-01-27 04:29 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll 2008-03-29 16:03 . 2006-01-27 04:29 94,298 --a------ C:\WINDOWS\system32\SynTPAPI.dll 2008-03-29 16:03 . 2006-01-27 04:29 82,013 --a------ C:\WINDOWS\system32\SynCOM.dll 2008-03-29 16:03 . 2006-01-27 04:56 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll 2008-03-29 16:03 . 2006-01-27 04:52 69,722 --a------ C:\WINDOWS\system32\SynTPFcs.dll 2008-03-29 16:02 . 2008-03-29 16:02 <DIR> d-------- C:\Program Files\Wireless Console 2 2008-03-29 16:02 . 2005-10-17 17:09 987,136 --a------ C:\WINDOWS\system32\wcourier.exe 2008-03-29 16:02 . 2003-02-21 20:42 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-03-29 16:01 . 2008-03-29 16:01 <DIR> d-------- C:\WINDOWS\OPTIONS 2008-03-29 16:01 . 2005-11-16 09:08 78,976 --a------ C:\WINDOWS\system32\drivers\Rtenicxp.sys 2008-03-29 16:01 . 2008-03-29 16:12 1,606 --a------ C:\WINDOWS\system32\PerfStringBackup.TMP 2008-03-29 16:00 . 2006-04-19 19:50 17,152 --------- C:\WINDOWS\system32\dllcache\usbohci.sys 2008-03-29 08:37 . 2003-07-29 11:18 3,839 --a------ C:\WINDOWS\system32\drivers\GETPADD.sys 2008-03-29 08:33 . 2008-03-29 08:32 103,953 -r-hs---- C:\gjn2pjlw.exe 2008-03-29 08:13 . 2008-03-29 08:13 <DIR> d---s---- C:\Documents and Settings\Dennis Hsu\UserData 2008-03-29 08:06 . 2008-03-29 08:06 <DIR> d-------- C:\WINDOWS\ANSAV_AIO 2008-03-29 07:51 . 2008-03-29 07:51 0 --a------ C:\WINDOWS\system32\drivers\1043_ASUSTeK_W7J.alu . (((((((((((((((((((((((((((((((((((( 近三個月內更動的檔案 ))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-29 07:58 --------- d-----w C:\Program Files\ASUS 2008-03-29 07:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-29 07:57 --------- d-----w C:\Program Files\Realtek 2008-03-29 07:57 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-03-29 07:53 --------- d-----w C:\Program Files\Intel 2008-03-29 07:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI 2008-03-29 07:48 --------- d-----w C:\Program Files\microsoft frontpage . ((((((((((((((((((((((((((((( snapshot@2008-03-29_ 8.28.25.85 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-04 12:00:00 36,864 ----a-w C:\WINDOWS\system32\dllcache\wups.dll + 2007-07-30 11:18:40 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll - 2004-08-04 12:00:00 36,864 ----a-w C:\WINDOWS\system32\wups.dll + 2007-07-30 11:18:40 33,624 ----a-w C:\WINDOWS\system32\wups.dll . (((((((((((((((((((((((((((((((((((((((((( 重要登錄檔 ))))))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *注意* 空白或合法的登錄值將不會顯示 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:59 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00 455168] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-02-23 05:40 106496] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-02-08 22:06 7405568] "nwiz"="nwiz.exe" [2006-02-08 22:06 1519616 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-02-08 22:06 86016] "SMSERIAL"="sm56hlpr.exe" [2006-01-20 05:34 544768 C:\WINDOWS\sm56hlpr.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-12-19 07:52 15797248 C:\WINDOWS\RTHDCPL.exe] "ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 15:20 180224] "Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 17:09 987136] "ACMON"="C:\Program Files\ASUS\Splendid\ACMON.exe" [2006-02-21 19:36 17920] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-27 04:51 761946] "Zshutdown"="c:\sysprep\patch\sysprep.cmd" [ ] "ABLKSR"="C:\windows\ABLKSR\ABLKSR.exe" [2006-01-03 03:14 61440] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-08-28 06:22 58488] "Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-14 17:46 90112] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55 667718] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56 602182] "EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2005-12-28 12:00 569413] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 20:00 15360] C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\ Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-09-06 15:57:48 581693] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN] IfxWlxEN.dll 2006-03-10 08:20 434176 C:\WINDOWS\system32\IfxWlxEN.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= R1 PersonalSecureDrive;PersonalSecureDrive;C:\WINDOWS\system32\drivers\psd.sys [2005-11-29 11:50] R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-10-21 04:19] R3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2006-01-04 10:42] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f798c44e-fda5-11dc-891f-806d6172696f}] \Shell\AutoRun\command - D:\1weicxa.com \Shell\explore\Command - D:\1weicxa.com \Shell\open\Command - D:\1weicxa.com . 排程工作資料夾的內容 "2008-03-29 08:41:38 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Dennis Hsu.job" - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/task: . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-29 08:37:29 Windows 5.1.2600 Service Pack 2 FAT NTAPI 掃描隱藏的程序... 掃描隱藏的進程... 掃描隱藏的檔案... 掃描完成 隱藏檔案?: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\WINDOWS\system32\IFXSPMGT.exe C:\WINDOWS\ATK0100\ATKOSD.exe c:\WINDOWS\system32\IFXTCS.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\imapi.exe c:\Program Files\Infineon\Security Platform Software\PSDrt.exe c:\Program Files\Infineon\Security Platform Software\SpTna.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe . ************************************************************************** . 完成時間?: 2008-03-29 8:38:36 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-29 00:38:30 ComboFix2.txt 2008-03-29 00:29:20 8 個目錄 39,481,081,856 位元組可用 10 個目錄 39,470,465,024 位元組可用 HighjackThis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 上午 08:44:58, on 2008/3/29 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\sm56hlpr.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ASUS\ASUS Live Update\ALU.exe C:\Program Files\Wireless Console 2\wcourier.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\WINDOWS\system32\IFXSPMGT.exe C:\WINDOWS\ATK0100\ATKOSD.exe c:\WINDOWS\system32\IFXTCS.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe c:\Program Files\Infineon\Security Platform Software\PSDrt.exe c:\Program Files\Infineon\Security Platform Software\SpTna.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Zshutdown] c:\sysprep\patch\sysprep.cmd O4 - HKLM\..\Run: [ABLKSR] C:\windows\ABLKSR\ABLKSR.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - c:\WINDOWS\system32\IFXSPMGT.exe O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - c:\WINDOWS\system32\IFXTCS.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe -- End of file - 8479 bytes Thanks. |
 |
 
|
|
Mar 28 2008, 11:14 PM
Post
#2
|
|
 OBleepin Investigator Group: Moderator Posts: 19,717 Joined: 14-July 06 From: Bloomington, IN Member No.: 76,150 |
Hello boyhsu and welcome to BC
 ComboFix logs should not to be posted outside the HijackThis forums. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again. Please create a new topic explaining the nature of your problem. Describe pop-ups and system tray or desktop icons that have appeared. Explain what is "going wrong" with your computer. Note any tools you have used and their respective results. If needed, we will direct you to our HJT Preparation Guide. Thank you for using BleepingComputer as your malware removal source. This topic is now closed. The BC Staff -------------------- Orange Blossom An ounce of prevention is worth a pound of cure ESET NOD32, SuperAntiSpyware Pro, SpywareBlaster, Spybot 1.6.2.46, WinPatrol Plus, Sunbelt Personal Firewall - Full, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 9th February 2010 - 03:26 PM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.