Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan/worms Infected


  • This topic is locked This topic is locked
17 replies to this topic

#1 Learner87

Learner87

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 23 May 2008 - 01:06 AM

Deckard's System Scanner v20071014.68
Run by user on 2008-05-23 13:49:29
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


-- Last 1 Restore Point(s) --
1: 2008-05-23 05:49:32 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

System Drive C: has 5.23 GiB (less than 15%) free.


-- HijackThis (run as user.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:55:22 PM, on 5/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\QvodPlayer\QvodTerminal.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\3.0\Apps\apdproxy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.exe
C:\PROGRA~1\Cacheman\Cacheman.exe
C:\DOCUME~1\user\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Downloads\dss.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\NclBTHandler.exe
C:\PROGRA~1\HIJACK~1\user.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BLin IeDoor Class - {A7934164-66CE-4B01-AD28-A42F734E448D} - C:\Documents and Settings\user\blin\blinplug.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [powerword 2007] "C:\Program Files\Kingsoft\Powerword 2007\xdict.exe" -s -nosplash
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: AutorunsDisabled
O4 - Global Startup: 20-20 Shortcut Bar.lnk = C:\2020V61\Mswin\60\SCBar.Exe
O4 - Global Startup: AutorunsDisabled
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &使用比邻下载(&:thumbsup: - C:\Documents and Settings\user\blin\ctxmenu.htm
O8 - Extra context menu item: Atomic Email Hunter - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Atomic Email Hunter - {491A6C2B-1046-486b-8A8F-7D26BCB79A9B} - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Atomic Email Hunter - {491A6C2B-1046-486b-8A8F-7D26BCB79A9B} - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase9602.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Qvod Terminal - Shenzhen QVOD Technology Co.,Ltd - C:\Program Files\QvodPlayer\QvodTerminal.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 12374 bytes

-- File Associations -----------------------------------------------------------

.bat - batfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,71
.cmd - cmdfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-153
.hlp - hlpfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,23
.inf - inffile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69
.inf - inffile - shell\open\command - C:\WINDOWS\System32\NOTEPAD.EXE "%1"
.ini - inifile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69
.js - JSFile - DefaultIcon - C:\WINDOWS\System32\WScript.exe,3
.js - JSFile - shell\open\command - C:\WINDOWS\System32\WScript.exe "%1"
.pif - unable to read key
.reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
.reg - regfile - shell\open\command - "regedit.exe" "%1"
.scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\system32\notepad.exe" "%1"
.txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,70
.vbs - VBSFile - DefaultIcon - C:\WINDOWS\system32\WScript.exe,2
.vbs - VBSFile - shell\open\command - C:\WINDOWS\System32\WScript.exe "%1"


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 ifp700 (iriver Internet Audio Player IFP-700) - c:\windows\system32\drivers\ifp700.sys <Not Verified; iRiver, Inc.; IFP-100>
R0 prohlp02 (StarForce Protection Helper Driver v2) - c:\windows\system32\drivers\prohlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 prosync1 (StarForce Protection Synchronization Driver v1) - c:\windows\system32\drivers\prosync1.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfhlp01 (StarForce Protection Helper Driver) - c:\windows\system32\drivers\sfhlp01.sys <Not Verified; Protection Technology; StarForce Protection System>
R1 atitray - c:\program files\radeon omega drivers\v3.8.252\ati tray tools\atitray.sys
R1 Hotkey - c:\windows\system32\drivers\hotkey.sys
R1 prodrv06 (StarForce Protection Environment Driver v6) - c:\windows\system32\drivers\prodrv06.sys <Not Verified; Protection Technology; StarForce Protection System>
R2 BTSERIAL (Bluetooth Serial Driver) - c:\windows\system32\drivers\btserial.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 5.0.1.1200>
R2 osaio - c:\windows\system32\drivers\osaio.sys <Not Verified; Windows ® 2000 DDK provider; OSA I/O Port Driver Version 1.0.5>
R2 osanbm - c:\windows\system32\drivers\osanbm.sys <Not Verified; Windows ® 2000 DDK provider; OSA int15 Driver Version 2.0.2>
R2 Sentinel - c:\windows\system32\drivers\sentinel.sys <Not Verified; SafeNet, Inc.; Sentinel System Driver>
R3 LVPrcMon (Logitech LVPrcMon Driver) - c:\windows\system32\drivers\lvprcmon.sys
R3 POWERKEY - c:\program files\launch manager\powerkey.sys

S0 sptd - c:\windows\system32\drivers\sptd.sys (file missing)
S2 npkcrypt - c:\program files\wizet\maplestory\npkcrypt.sys (file missing)
S3 btwmodem (Bluetooth Modem) - c:\windows\system32\drivers\btwmodem.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 5.0.1.1200>
S3 flash - c:\windows\system32\drivers\flash.sys
S3 NSNDIS5 (NSNDIS5 NDIS Protocol Driver) - c:\windows\system32\nsndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); NetStumbler>
S3 WINIO - c:\documents and settings\user\my documents\download\keyboard controller firmware 1.37\winio.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 anbmService (Notebook Manager Service) - c:\acer\emanager\anbmserv.exe <Not Verified; OSA Technologies Inc.; Acer Empowering Manager>
R2 Qvod Terminal - c:\program files\qvodplayer\qvodterminal.exe <Not Verified; Shenzhen QVOD Technology Co.,Ltd; QvodTerminal>
R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia Windows Portable Device Driver
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: DANNY
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 5300
Device ID: ROOT\WPD\0001
Manufacturer: Nokia
Name: Nokia 5300
PNP Device ID: ROOT\WPD\0001
Service: WUDFRd


-- Scheduled Tasks -------------------------------------------------------------

2008-05-17 09:00:00 346 --a------ C:\WINDOWS\Tasks\At1.job


-- Files created between 2008-04-23 and 2008-05-23 -----------------------------

2008-05-23 11:52:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-23 11:52:43 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-23 11:52:36 0 d-------- C:\WINDOWS\LastGood
2008-05-16 17:01:20 1140152 --a------ C:\WINDOWS\Kupp.scr <Not Verified; Teka Kuchentechnik (M) Sdn. Bhd.; Teka Screensaver>
2008-05-12 07:42:17 0 d-------- C:\Program Files\MSXML 6.0
2008-04-26 22:32:14 0 d-------- C:\Program Files\Common Files\xing shared
2008-04-23 16:49:31 544768 --a------ C:\WINDOWS\system32\msvcr71d.dll <Not Verified; Microsoft Corporation; Microsoft? Visual Studio .NET>
2008-04-23 16:49:30 327680 --a------ C:\WINDOWS\system32\SmaRTEng.dll <Not Verified; ; SmaRTEng Module>
2008-04-23 16:49:30 765952 --a------ C:\WINDOWS\system32\msvcp71d.dll <Not Verified; Microsoft Corporation; Microsoft? Visual Studio .NET>
2008-04-23 16:49:30 2174464 --a------ C:\WINDOWS\system32\mfc71ud.dll <Not Verified; Microsoft Corporation; Microsoft? Visual Studio .NET>
2008-04-23 16:49:30 2179072 --a------ C:\WINDOWS\system32\mfc71d.dll <Not Verified; Microsoft Corporation; Microsoft? Visual Studio .NET>
2008-04-23 16:46:11 0 d-------- C:\2020Reports
2008-04-23 16:26:09 0 d-------- C:\Program Files\SafeNet Sentinel
2008-04-23 16:26:09 0 d-------- C:\Program Files\Common Files\SafeNet Sentinel


-- Find3M Report ---------------------------------------------------------------

2008-05-23 11:41:11 0 d-------- C:\Program Files\Mozilla Firefox 3 Beta 4
2008-05-23 11:35:55 0 d-------- C:\Documents and Settings\user\Application Data\AVG7
2008-05-15 00:03:42 0 d-------- C:\Documents and Settings\user\Application Data\LimeWire
2008-05-12 07:42:46 0 d-------- C:\Program Files\Nokia
2008-05-12 07:39:39 0 d-------- C:\Program Files\Common Files\Nokia
2008-05-09 01:47:57 0 d-------- C:\Program Files\Windows Live Safety Center
2008-04-29 18:37:07 0 d-------- C:\Program Files\CA Yahoo! Anti-Spy
2008-04-29 18:37:07 0 d-------- C:\Program Files\ActMon-Password-Recovery
2008-04-26 22:32:14 0 d-------- C:\Program Files\Common Files
2008-04-26 22:32:05 0 d-------- C:\Program Files\Common Files\Real
2008-04-24 01:13:28 0 d-------- C:\Documents and Settings\user\Application Data\Real
2008-04-23 16:45:38 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-23 16:30:15 73 --a------ C:\WINDOWS\system32\ssprs.dll
2008-04-23 16:30:15 340 --a------ C:\WINDOWS\system32\lsprst7.dll
2008-04-20 21:55:29 67088 --a------ C:\Documents and Settings\user\Application Data\GDIPFONTCACHEV1.DAT
2008-04-16 09:17:09 1025 --a------ C:\WINDOWS\system32\sysprs7.dll
2008-04-16 09:17:09 1025 --a------ C:\WINDOWS\system32\clauth2.dll
2008-04-16 09:17:09 1025 --a------ C:\WINDOWS\system32\clauth1.dll
2008-04-15 09:04:13 0 d-------- C:\Program Files\BitComet
2008-04-15 00:19:43 2560 --a------ C:\WINDOWS\system32\bitcometres.dll <Not Verified; BitComet; BitComet BCTP Helper>
2008-04-13 12:52:51 0 d-------- C:\Program Files\ATI Technologies
2008-04-08 21:39:33 0 d-------- C:\Program Files\Replay Converter
2008-04-06 18:59:56 0 d-------- C:\Program Files\vixy.net
2008-04-06 18:01:09 0 d-------- C:\Program Files\JCS
2008-03-25 07:30:54 0 d-------- C:\Program Files\TCP Optimizer
2008-03-23 18:14:59 0 d-------- C:\Program Files\DivX
2008-03-23 05:35:37 0 d-------- C:\Program Files\Messenger Plus! Live
2008-03-23 05:35:35 0 d-------- C:\Program Files\Windows Live
2008-03-23 05:35:35 0 d-------- C:\Program Files\MSN Messenger
2008-03-23 05:23:54 0 d-------- C:\Program Files\Common Files\QvodPlayer
2008-03-23 04:53:10 0 d-------- C:\Documents and Settings\user\Application Data\VersionTracker Pro
2008-03-23 04:04:13 0 d-------- C:\Program Files\TechTracker
2008-03-10 05:08:31 2536 --a------ C:\WINDOWS\unins000.dat
2008-03-10 04:06:59 691545 --a------ C:\WINDOWS\unins000.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A7934164-66CE-4B01-AD28-A42F734E448D}]
03/17/2008 04:22 AM 107896 --a------ C:\Documents and Settings\user\blin\blinplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [11/08/2005 10:19 AM]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [12/16/2005 11:32 PM]
"PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [08/30/2002 03:02 PM]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [09/16/2003 02:28 PM]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [07/25/2005 10:45 AM]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [01/10/2006 06:06 PM]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [07/25/2005 01:36 PM]
"RTHDCPL"="RTHDCPL.EXE" [06/28/2006 02:54 PM C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [05/16/2006 06:04 PM C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [01/25/2006 06:45 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/15/2008 08:26 AM]
"PC Suite for Smartphones"="C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [05/28/2007 10:14 AM]
"powerword 2007"="C:\Program Files\Kingsoft\Powerword 2007\xdict.exe" []
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [01/02/2006 05:41 PM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/26/2008 10:31 PM]
"Adobe Photo Downloader"="C:\3.0\Apps\apdproxy.exe" [06/06/2005 11:46 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM]
"AtiTrayTools"="C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.exe" [04/17/2006 01:24 PM]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" []
"Cacheman"="C:\PROGRA~1\Cacheman\Cacheman.exe" [07/31/2003 02:13 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NofolderOptions"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 12/06/2005 09:16 PM 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eb03669-8f5c-11db-bdd9-00130201798b}]
Auto\command- F:\RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{334b9f20-ab54-11dc-8d3c-00130201798b}]
Auto\command- F:\RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{362a0dc7-5449-11dc-8085-00130201798b}]
Auto\command- infrom.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f363b6b-3bbc-11db-bc50-00130201798b}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe a.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ecc1a3-493f-11dc-805d-00130201798b}]
AutoRun\command- G:\mka.bat
explore\Command- G:\mka.bat
open\Command- G:\mka.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2ee5ef6-3662-11db-bc3f-00130201798b}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe a.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e76570ca-15b1-11dd-8e16-00130201798b}]
AutoRun\command- ie.exe
explore\Command- ie.exe
open\Command- ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eadbe63c-f29a-11dc-8db4-00130201798b}]
AutoRun\command- wscript.exe VirusRemoval.vbs
open\Command- wscript.exe VirusRemoval.vbs




-- Hosts -----------------------------------------------------------------------

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

8004 more entries in hosts file.


-- End of Deckard's System Scanner: finished at 2008-05-23 13:56:20 ------------
Posted Image

BC AdBot (Login to Remove)

 


#2 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:10 PM

Posted 07 June 2008 - 11:46 PM

Hello Learner87,

Sorry for the delay. If you still need help, please post a fresh DSS log.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 09 June 2008 - 05:26 AM

Deckard's System Scanner v20071014.68
Run by user on 2008-06-09 18:19:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

System Drive C: has 0.61 GiB (less than 15%) free.


-- HijackThis (run as user.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:20:26 PM, on 6/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\3.0\Apps\apdproxy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.exe
C:\PROGRA~1\Cacheman\Cacheman.exe
C:\DOCUME~1\user\LOCALS~1\Temp\RtkBtMnt.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\QvodPlayer\QvodTerminal.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox 3 Beta 4\firefox.exe
C:\Documents and Settings\user\My Documents\Download\dss.exe
C:\WINDOWS\system32\conime.exe
C:\PROGRA~1\HIJACK~1\user.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BLin IeDoor Class - {A7934164-66CE-4B01-AD28-A42F734E448D} - C:\Documents and Settings\user\blin\blinplug.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [powerword 2007] "C:\Program Files\Kingsoft\Powerword 2007\xdict.exe" -s -nosplash
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: AutorunsDisabled
O4 - Global Startup: 20-20 Shortcut Bar.lnk = C:\2020V61\Mswin\60\SCBar.Exe
O4 - Global Startup: AutorunsDisabled
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &使用比邻下载(&:thumbsup: - C:\Documents and Settings\user\blin\ctxmenu.htm
O8 - Extra context menu item: Atomic Email Hunter - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Atomic Email Hunter - {491A6C2B-1046-486b-8A8F-7D26BCB79A9B} - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Atomic Email Hunter - {491A6C2B-1046-486b-8A8F-7D26BCB79A9B} - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase9602.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Qvod Terminal - Shenzhen QVOD Technology Co.,Ltd - C:\Program Files\QvodPlayer\QvodTerminal.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 11812 bytes

-- Files created between 2008-05-09 and 2008-06-09 -----------------------------

2008-06-06 15:38:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Sandlot Games
2008-06-06 15:36:39 0 d-------- C:\Program Files\Tradewinds Legends
2008-06-06 15:35:59 0 d-------- C:\Program Files\ReflexiveArcade
2008-06-02 13:34:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
2008-06-01 22:07:41 0 d-------- C:\Program Files\Microsoft Games
2008-05-31 22:52:53 0 d-------- C:\Documents and Settings\Admin\Application Data\Teleca
2008-05-31 22:52:41 0 d-------- C:\Documents and Settings\Admin\Application Data\ATI
2008-05-31 22:52:39 0 d-------- C:\Documents and Settings\Admin\Application Data\Real
2008-05-31 22:52:39 0 d-------- C:\Documents and Settings\Admin\Application Data\AVG7
2008-05-31 22:52:34 0 d-------- C:\Documents and Settings\Admin\Application Data\Sony Ericsson
2008-05-31 22:52:15 0 d-------- C:\Documents and Settings\Admin\Application Data\Identities
2008-05-31 22:49:53 0 d--h----- C:\Documents and Settings\Admin\Templates
2008-05-31 22:49:53 0 dr------- C:\Documents and Settings\Admin\Start Menu
2008-05-31 22:49:53 0 dr-h----- C:\Documents and Settings\Admin\SendTo
2008-05-31 22:49:53 0 dr-h----- C:\Documents and Settings\Admin\Recent
2008-05-31 22:49:53 0 d--h----- C:\Documents and Settings\Admin\PrintHood
2008-05-31 22:49:53 0 d--h----- C:\Documents and Settings\Admin\NetHood
2008-05-31 22:49:53 0 dr------- C:\Documents and Settings\Admin\My Documents
2008-05-31 22:49:53 0 d--h----- C:\Documents and Settings\Admin\Local Settings
2008-05-31 22:49:53 0 dr------- C:\Documents and Settings\Admin\Favorites
2008-05-31 22:49:53 0 d-------- C:\Documents and Settings\Admin\Desktop
2008-05-31 22:49:53 0 d---s---- C:\Documents and Settings\Admin\Cookies
2008-05-31 22:49:53 0 dr-h----- C:\Documents and Settings\Admin\Application Data
2008-05-31 22:49:53 0 d---s---- C:\Documents and Settings\Admin\Application Data\Microsoft
2008-05-31 22:49:52 2097152 --ah----- C:\Documents and Settings\Admin\NTUSER.DAT
2008-05-24 21:35:48 0 d-------- C:\WINDOWS\system32\SupportAppXL
2008-05-24 21:35:35 0 d-------- C:\Program Files\U Mobile Broadband Connection
2008-05-23 11:52:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-23 11:52:43 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-16 17:01:20 1140152 --a------ C:\WINDOWS\Kupp.scr <Not Verified; Teka Kuchentechnik (M) Sdn. Bhd.; Teka Screensaver>
2008-05-12 07:42:17 0 d-------- C:\Program Files\MSXML 6.0


-- Find3M Report ---------------------------------------------------------------

2008-06-09 13:04:39 0 d-------- C:\Documents and Settings\user\Application Data\AVG7
2008-06-09 11:24:05 0 d-------- C:\Program Files\Mozilla Firefox 3 Beta 4
2008-06-03 13:12:51 0 d-------- C:\Documents and Settings\user\Application Data\LimeWire
2008-05-24 21:35:34 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-12 07:42:46 0 d-------- C:\Program Files\Nokia
2008-05-12 07:39:39 0 d-------- C:\Program Files\Common Files\Nokia
2008-05-09 01:47:57 0 d-------- C:\Program Files\Windows Live Safety Center
2008-04-29 18:37:07 0 d-------- C:\Program Files\CA Yahoo! Anti-Spy
2008-04-29 18:37:07 0 d-------- C:\Program Files\ActMon-Password-Recovery
2008-04-26 22:32:14 0 d-------- C:\Program Files\Common Files
2008-04-26 22:32:14 0 d-------- C:\Program Files\Common Files\xing shared
2008-04-26 22:32:05 0 d-------- C:\Program Files\Common Files\Real
2008-04-24 01:13:28 0 d-------- C:\Documents and Settings\user\Application Data\Real
2008-04-23 16:30:15 73 --a------ C:\WINDOWS\system32\ssprs.dll
2008-04-23 16:30:15 340 --a------ C:\WINDOWS\system32\lsprst7.dll
2008-04-23 16:26:09 0 d-------- C:\Program Files\SafeNet Sentinel
2008-04-23 16:26:09 0 d-------- C:\Program Files\Common Files\SafeNet Sentinel
2008-04-20 21:55:29 67088 --a------ C:\Documents and Settings\user\Application Data\GDIPFONTCACHEV1.DAT
2008-04-16 09:17:09 1025 --a------ C:\WINDOWS\system32\sysprs7.dll
2008-04-16 09:17:09 1025 --a------ C:\WINDOWS\system32\clauth2.dll
2008-04-16 09:17:09 1025 --a------ C:\WINDOWS\system32\clauth1.dll
2008-04-15 09:04:13 0 d-------- C:\Program Files\BitComet
2008-04-15 00:19:43 2560 --a------ C:\WINDOWS\system32\bitcometres.dll <Not Verified; BitComet; BitComet BCTP Helper>
2008-04-13 12:52:51 0 d-------- C:\Program Files\ATI Technologies
2008-03-10 05:08:31 2536 --a------ C:\WINDOWS\unins000.dat
2008-03-10 04:06:59 691545 --a------ C:\WINDOWS\unins000.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A7934164-66CE-4B01-AD28-A42F734E448D}]
03/17/2008 04:22 AM 107896 --a------ C:\Documents and Settings\user\blin\blinplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [11/08/2005 10:19 AM]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [12/16/2005 11:32 PM]
"PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [08/30/2002 03:02 PM]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [09/16/2003 02:28 PM]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [07/25/2005 10:45 AM]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [01/10/2006 06:06 PM]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [07/25/2005 01:36 PM]
"RTHDCPL"="RTHDCPL.EXE" [06/28/2006 02:54 PM C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [05/16/2006 06:04 PM C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [01/25/2006 06:45 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/15/2008 08:26 AM]
"PC Suite for Smartphones"="C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [05/28/2007 10:14 AM]
"powerword 2007"="C:\Program Files\Kingsoft\Powerword 2007\xdict.exe" []
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [01/02/2006 05:41 PM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/26/2008 10:31 PM]
"Adobe Photo Downloader"="C:\3.0\Apps\apdproxy.exe" [06/06/2005 11:46 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 11:43 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM]
"AtiTrayTools"="C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.exe" [04/17/2006 01:24 PM]
"FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" []
"Cacheman"="C:\PROGRA~1\Cacheman\Cacheman.exe" [07/31/2003 02:13 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NofolderOptions"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 12/06/2005 09:16 PM 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eb03669-8f5c-11db-bdd9-00130201798b}]
Auto\command- F:\RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32d9709d-2d2b-11dd-8e4b-00130201798b}]
Auto\command- MicrosoftPowerPoint.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{334b9f20-ab54-11dc-8d3c-00130201798b}]
Auto\command- F:\RavMonE.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{362a0dc7-5449-11dc-8085-00130201798b}]
Auto\command- infrom.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f363b6b-3bbc-11db-bc50-00130201798b}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe a.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ecc1a3-493f-11dc-805d-00130201798b}]
Auto\command- MicrosoftPowerPoint.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d2ee5ef6-3662-11db-bc3f-00130201798b}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe a.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e76570ca-15b1-11dd-8e16-00130201798b}]
AutoRun\command- ie.exe
explore\Command- ie.exe
open\Command- ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eadbe63c-f29a-11dc-8db4-00130201798b}]
AutoRun\command- wscript.exe VirusRemoval.vbs
open\Command- wscript.exe VirusRemoval.vbs




-- End of Deckard's System Scanner: finished at 2008-06-09 18:20:58 ------------
Posted Image

#4 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:10 PM

Posted 09 June 2008 - 11:56 AM

Hi Learner87,

-- File Associations -----------------------------------------------------------

.bat - batfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,71
.cmd - cmdfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-153
.hlp - hlpfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,23



Did you fix the file associations youself?
The second log you posted do not list them. :thumbsup:




Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Sun Java Runtime Environment 6 Update 6.
  • Scroll down to where it says "Sun Java Runtime Environment 6 Update 6".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language jre-6u6-windows-i586.exe and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    Examples of older versions in Add or Remove Programs:
    Java 2 Runtime Environment, SE v1.4.2
    J2SE Runtime Environment 5.0
    J2SE Runtime Environment 5.0 Update 6
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.


I notice that you have Spybot's TeaTimer running.
While this is normally a wonderful tool to protect against hijackers, it can also interfere with the fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts

You can reenable TeaTimer once your system is clean.


Download CCleaner and install it. (default location is best). Do not run it yet!

Beginners Guide to CCleaner

*******************************************


Please run HijackThis and click "Scan." Place checks next to the following entries, if present:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BLin IeDoor Class - {A7934164-66CE-4B01-AD28-A42F734E448D} - C:\Documents and Settings\user\blin\blinplug.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Atomic Email Hunter - {491A6C2B-1046-486b-8A8F-7D26BCB79A9B} - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm (file missing) (HKCU)O9 - Extra 'Tools' menuitem: Atomic Email Hunter - {491A6C2B-1046-486b-8A8F-7D26BCB79A9B} - C:\Program Files\AtomPark\Atomic Email Hunter\ie.htm (file missing) (HKCU)


Close all browsers and other windows except for HijackThis, and click "Fix checked"

*******************************************

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders and does not make backups.

Let's empty the temp files:

Run CCleaner.

CAUTION: Please do NOT use the Issues or Registry button. This is a built-in registry cleaner. If you don't know how to use it, you may cause irreparable damage to your system.

1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation.
IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbarfree Basic version instead of the Standard Build.


2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"

3. Then select the items you wish to clean up.

In the Windows Tab:
Clean all entries in the "Internet Explorer" section except Autocomplete Forum History.
Clean all the entries in the "Windows Explorer" section.
Clean all entries in the "System" section except for Start Menu Shortcuts and Desktop Shortcuts.
Clean any others that you choose.

In the Applications Tab:
Clean all including cookies in the Firefox/Mozilla section if you use it.
Clean all in the Opera section if you use it.
Clean Sun Java in the Internet Section.
Clean any others that you choose.

4. Click the "Run Cleaner" button.
5. A pop up box will appear advising this process will permanently delete files from your system.
6. Click "OK" and it will scan and clean your system.
7. Click "exit" when done.

If it asks you to reboot at the end, click NO.

CCleaner should be run with the above settings for each User Account!

*******************************************

Reboot your computer.

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Copy and Paste the entire report.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediatly.







Please perform this online scan: Kaspersky Webscan

Note that you need to run this scan with Internet Explorer for it to work correctly.

If you have any problem running the scan to completion, disable your Antivirus and/or firewall temporarily, just refrain from surfing around while the scan is running and be sure to re-enable when done.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license is accepted, reset to 100%.

1. Read the Requirements and Privacy statement, then select "Accept"
2. A dialogue box will appear asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
NOTE: If you are running XP SP2, you may need to click on the Information Bar to allow the ActiveX to install and may need to repeat step 1.
3. Select "Install" to download the ActiveX controls that allows Kaspersky to run.
4. If running MSAS beta you may receive an alert that an IE ActiveX program requires your approval. Click "Allow"
5. Wait for the scanner to initialize and update its databases. When the download is complete it will say ready, click "Next"
6. Click "Scan Settings" and check the option to use the EXTENDED DATABASE,
Scan Options:
Scan Archives
Scan Mail Bases


then click "OK"
7. Select a target to scan: Click on "My Computer" and the scan will begin.
8. Once the scan is complete it will display if your system has been infected.
Now click on the Save Report As... button:

Posted Image

Under Save as type select Text file write name for the file and save it to your Desktop.
Locate the file at the Desktop, open it, then copy and paste that information in your next post.
9. Post the Kaspersky scan, Malwarebytes' Anti-Malware log, a fresh Hijackthis log and tell me how your computer is running.

Edited by SifuMike, 09 June 2008 - 11:57 AM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 12 June 2008 - 03:50 AM

Malwarebytes' Anti-Malware 1.17
Database version: 846

7:34:56 PM 6/11/2008
mbam-log-6-11-2008 (19-34-56).txt

Scan type: Quick Scan
Objects scanned: 42603
Time elapsed: 7 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Posted Image

#6 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 12 June 2008 - 03:52 AM

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, June 12, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, June 12, 2008 02:07:07
Records in database: 854438
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 252157
Threat name: 6
Infected objects: 9
Suspicious objects: 0
Duration of the scan: 02:49:41


File name / Threat name / Threats count
C:\Documents and Settings\user\My Documents\Frm Pendrive\aircrack-ng-0.9.1-win.zip Infected: not-a-virus:PSWTool.Win32.AirCrack.a 1
C:\Program Files\Common Files\QvodPlayer\Codecs\AviSplitter.ax Infected: not-a-virus:AdWare.Win32.SeeCha.e 1
C:\Program Files\QvodPlayer\Codecs\RealMediaSplitter.ax Infected: not-a-virus:AdWare.Win32.SeeCha.d 1
C:\Program Files\QvodPlayer\QvodUpdate.exe Infected: not-a-virus:AdWare.Win32.SeeCha.d 1
C:\Program Files\Windows Optimizer - System and Disk Cleaner\Data\ToolDiskCleaner\Backup\2007-10-19_03-22-26\C\DOCUME~1\user\LOCALS~1\Temp\mirc63.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.63 1
C:\Program Files\Windows Optimizer - System and Disk Cleaner\Data\ToolDiskCleaner\Backup\2007-12-02_17-20-36\C\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\UDSFGRAH\qvodSetup[1].exe Infected: not-a-virus:AdWare.Win32.SeeCha.d 1
C:\WINDOWS\RavMonE.exe Infected: Worm.Win32.RJump.a 1
D:\Incomplete\Preview-T-5745425-woopsy.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
D:\Incomplete\T-5745425-woopsy.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1

The selected area was scanned.
Posted Image

#7 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 12 June 2008 - 03:56 AM

Thanks Sifu, u solved my problem. But I still notice tht there some threats in my computer. How can I remove these threats?
Posted Image

#8 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:10 PM

Posted 12 June 2008 - 09:58 AM

Hi Learner87,

Please download the
OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
    (if you are running on Vista then right-click the program and choose Run as Administrator).
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\Documents and Settings\user\My Documents\Frm Pendrive\aircrack-ng-0.9.1-win.zip
    C:\Program Files\Common Files\QvodPlayer\Codecs\AviSplitter.ax
    C:\Program Files\QvodPlayer\Codecs\RealMediaSplitter.ax
    C:\Program Files\QvodPlayer\QvodUpdate.exe
    C:\Program Files\Windows Optimizer - System and Disk Cleaner\Data\ToolDiskCleaner\Backup\2007-12-02_17-20-36\C\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\UDSFGRAH\qvodSetup[1].exe
    C:\WINDOWS\RavMonE.exe
    D:\Incomplete\Preview-T-5745425-woopsy.mp3
    D:\Incomplete\T-5745425-woopsy.mp3


  • Return to OTMoveIt2, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Note : If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
    C:\_OTMoveIt2\MovedFiles\********_******.log
    (where "********_******" is the "date_time")
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Caution: Be careful of what you copy and paste with this tool. OTMoveIt2 is a powerful program, designed to move highly persistent files and folders. Not following the directions as instructed or using incorrectly could lead to disastrous problems with your operating system.


Post the OTMoveIt2 log. Run Kaspersky online scan again and post its log.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#9 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 12 June 2008 - 12:25 PM

C:\Documents and Settings\user\My Documents\Frm Pendrive\aircrack-ng-0.9.1-win.zip moved successfully.
C:\Program Files\Common Files\QvodPlayer\Codecs\AviSplitter.ax moved successfully.
C:\Program Files\QvodPlayer\Codecs\RealMediaSplitter.ax moved successfully.
C:\Program Files\QvodPlayer\QvodUpdate.exe moved successfully.
< C:\Program Files\Windows Optimizer - System and Disk Cleaner\Data\ToolDiskCleaner\Backup\2007-12-02_17-20-36\C\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\UDSFGRAH\qvodSetup[1].exe >
C:\Program Files\Windows Optimizer - System and Disk Cleaner\Data\ToolDiskCleaner\Backup\2007-12-02_17-20-36\C\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\UDSFGRAH\qvodSetup[1].exe moved successfully.
C:\WINDOWS\RavMonE.exe moved successfully.
D:\Incomplete\Preview-T-5745425-woopsy.mp3 moved successfully.
D:\Incomplete\T-5745425-woopsy.mp3 moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06132008_012415
Posted Image

#10 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:10 PM

Posted 12 June 2008 - 01:13 PM

Run Kaspersky online scan again and post its log.


You forgot to post the Kaspersky online scan log. :thumbsup:
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#11 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 13 June 2008 - 09:19 PM

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, June 14, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, June 13, 2008 15:46:58
Records in database: 860378
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 253333
Threat name: 5
Infected objects: 6
Suspicious objects: 0
Duration of the scan: 02:55:19


File name / Threat name / Threats count
C:\Program Files\Windows Optimizer - System and Disk Cleaner\Data\ToolDiskCleaner\Backup\2007-10-19_03-22-26\C\DOCUME~1\user\LOCALS~1\Temp\mirc63.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.63 1
C:\_OTMoveIt\MovedFiles\06132008_012415\Documents and Settings\user\My Documents\Frm Pendrive\aircrack-ng-0.9.1-win.zip Infected: not-a-virus:PSWTool.Win32.AirCrack.a 1
C:\_OTMoveIt\MovedFiles\06132008_012415\Incomplete\Preview-T-5745425-woopsy.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\_OTMoveIt\MovedFiles\06132008_012415\Incomplete\T-5745425-woopsy.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\_OTMoveIt\MovedFiles\06132008_012415\Program Files\Common Files\QvodPlayer\Codecs\AviSplitter.ax Infected: not-a-virus:AdWare.Win32.SeeCha.e 1
C:\_OTMoveIt\MovedFiles\06132008_012415\WINDOWS\RavMonE.exe Infected: Worm.Win32.RJump.a 1

The selected area was scanned.
Posted Image

#12 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:10 PM

Posted 13 June 2008 - 09:39 PM

Hi Learner87,

Looks good. :thumbsup: How is the computer running?

We still have to the clean up.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#13 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 15 June 2008 - 12:22 PM

Running smooth. Thanks a lot ! Sifu! But my startup program seems abit slow... any solution?
Posted Image

#14 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:10 PM

Posted 15 June 2008 - 12:49 PM

Hi Learner87,

We can remove some startup items, and that will improve your start up time.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Sun Java Runtime Environment 6 Update 6.
  • Scroll down to where it says "Sun Java Runtime Environment 6 Update 6".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language jre-6u6-windows-i586.exe and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.

    Examples of older versions in Add or Remove Programs:
    Java 2 Runtime Environment, SE v1.4.2
    J2SE Runtime Environment 5.0
    J2SE Runtime Environment 5.0 Update 6
    J2SE Runtime Environment 6.0 Update 5

  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.

*******************************************


Please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts

You can reenable TeaTimer once your system is clean.

Download CCleaner and install it. (default location is best). Do not run it yet!

Beginners Guide to CCleaner

*******************************************


Please run HijackThis and click "Scan." Place checks next to the following entries, if present:

These are optional fixes. The following are not necessarily spyware/malware, but I suggest you place a check mark next to the following entries, as these programs may be taking up system resources.

O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe\"
(Description: Sun Java update scheduler. Checks for updates. Not necessary. Removing this entry will free up a small amount of system resources.)

O4 - HKLM\..\Run: [TkBellExe] \"C:\Program Files\Common Files\Real\Update_OB\realsched.exe\" -osboot
(Description: RealPlayer scheduler. Completely unnecessary. Removing this entry will free up a small amount of system resources.)

Close all browsers and other windows except for HijackThis, and click "Fix checked"

*******************************************

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders and does not make backups.

Let's empty the temp files:

Run CCleaner.

CAUTION: Please do NOT use the Issues or Registry button. This is a built-in registry cleaner. If you don't know how to use it, you may cause irreparable damage to your system.

1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation.
IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbarfree Basic version instead of the Standard Build.


2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"

3. Then select the items you wish to clean up.

In the Windows Tab:
Clean all entries in the "Internet Explorer" section except Autocomplete Forum History.
Clean all the entries in the "Windows Explorer" section.
Clean all entries in the "System" section except for Start Menu Shortcuts and Desktop Shortcuts.
Clean any others that you choose.

In the Applications Tab:
Clean all including cookies in the Firefox/Mozilla section if you use it.
Clean all in the Opera section if you use it.
Clean Sun Java in the Internet Section.
Clean any others that you choose.

4. Click the "Run Cleaner" button.
5. A pop up box will appear advising this process will permanently delete files from your system.
6. Click "OK" and it will scan and clean your system.
7. Click "exit" when done.

If it asks you to reboot at the end, click NO.

CCleaner should be run with the above settings for each User Account!

*******************************************

Reboot your computer, post a new Hijackthis log, and tell me how your computer is running.

Edited by SifuMike, 15 June 2008 - 12:51 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#15 Learner87

Learner87
  • Topic Starter

  • Members
  • 132 posts
  • OFFLINE
  •  
  • Local time:10:10 AM

Posted 20 June 2008 - 03:54 AM

This is my desktop computer, can pls take a look of the report? Thanks. : )



-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, June 20, 2008 2:33:37 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/06/2008
Kaspersky Anti-Virus database records: 782784
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 111740
Number of viruses found: 10
Number of infected objects: 23
Number of suspicious objects: 0
Duration of the scan process: 00:52:56

Infected Object Name / Virus Name / Last Action
C:\2020V8\agents\AgFormat.ldb Object is locked skipped
C:\2020V8\agents\AgFormat.mdb Object is locked skipped
C:\2020V8\Cat\60\Common\kit11rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\kit11rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\kit14rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\m_room\kit11rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\m_room\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\m_room\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\m_room\kit14rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\raima\vista000.taf Object is locked skipped
C:\2020V8\Cat\60\Common\raima\VistaDBHandler.Lck Object is locked skipped
C:\2020V8\Cat\60\Common\room\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\room\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\room\kit14rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\room_app\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\room_app\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\room_app\kit14rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\room_m\kit11rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\room_m\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\room_m\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\room_m\kit14rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\rowenta\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\rowenta\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\rowenta\kit14rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\sample_m\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\sample_m\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\style_e\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\style_e\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\style_m\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\style_m\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\USER\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\USER\kit13rec.idx Object is locked skipped
C:\2020V8\Cat\60\Common\white_ri\kit13rec.dat Object is locked skipped
C:\2020V8\Cat\60\Common\white_ri\kit13rec.idx Object is locked skipped
C:\2020V8\Db\Sec\60\securitymanager.ldb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\164D63B5.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1DEC6A1D.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1F746749.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\27D079A9.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\323355B8.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3D513578.vbs Infected: Virus.VBS.Kersuc.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\434B46F8.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45054288.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5A342C28.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5BD70711.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5CD31B59.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5DD83E15.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64BA4997.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\77A940C7.exe Infected: Worm.Win32.Muha.a skipped
C:\Documents and Settings\All Users\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\All Users\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Application Data\Roxio\MediaManager9\Album.ldb Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Application Data\Roxio\MediaManager9\Album.psod Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Desktop\NEW ISKHANDAR.xlsx Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Desktop\~$NEW ISKHANDAR.xlsx Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\ApplicationHistory\Design.exe.69313b05.ini.inuse Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Messenger\lai_li@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Messenger\lai_li@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Messenger\lai_li@hotmail.com\SharingMetadata\Working\database_3008_27C1_827_84C6\dfsr.db Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Messenger\lai_li@hotmail.com\SharingMetadata\Working\database_3008_27C1_827_84C6\fsr.log Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Messenger\lai_li@hotmail.com\SharingMetadata\Working\database_3008_27C1_827_84C6\fsrtmp.log Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Messenger\lai_li@hotmail.com\SharingMetadata\Working\database_3008_27C1_827_84C6\tmp.edb Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Application Data\Microsoft\Windows Live Contacts\lai_li@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\History\History.IE5\MSHist012008062020080621\index.dat Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\hsperfdata_PuchongDesigners\1068 Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\JET13B9.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\JET27D6.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\JET83BA.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\MicrosoftPowerPoint\Install.txt Infected: Trojan.Win32.Agent.aoe skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DF1BA2.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DF58F9.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DF5906.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DF5EEE.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DF5EFB.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DF72FD.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DF998F.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DFD9D4.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~DFD9E4.tmp Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temp\~ROMFN_00000524 Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temporary Internet Files\Content.IE5\2XRZOYB8\photolist_ajax[3].htm Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temporary Internet Files\Content.IE5\I8SNCUM2\photolist_ajax[3].htm Object is locked skipped
C:\Documents and Settings\PuchongDesigners\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PuchongDesigners\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\PuchongDesigners\ntuser.dat.LOG Object is locked skipped
C:\heap41a\offspring\autorun.inf Infected: Trojan.Win32.AutoHK.bc skipped
C:\heap41a\reproduce.txt Infected: Virus.Win32.AutoHK.a skipped
C:\heap41a\script1.txt Infected: Trojan.Win32.AutoHK.a skipped
C:\heap41a\std.txt Infected: Trojan.Win32.AutoHK.bc skipped
C:\Media\Forensic.Heroes.II.EP19.rmvb.!mv Object is locked skipped
C:\Media\Forensic.Heroes.II.EP21.rmvb.!mv Object is locked skipped
C:\Media\GUESS-20080614.rmvb.!mv Object is locked skipped
C:\Media\yuanlaiwobushuai_08.rmvb.!mv Object is locked skipped
C:\Media\yuanlaiwobushuai_09.rmvb.!mv Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Incomplete\T-5020194-Dru Hill - I Love You.mp3 Object is locked skipped
C:\Program Files\Incomplete\T-5247260-Dru Hill - Dru Hill - Never Make A Promise.mp3 Object is locked skipped
C:\Program Files\LimeWire\darren hayes spin.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped
C:\Program Files\QvodPlayer\Qvod.cfg Object is locked skipped
C:\Program Files\U Mobile Broadband Connection\db.dat Object is locked skipped
C:\Program Files\U Mobile Broadband Connection\db.ldb Object is locked skipped
C:\RECYCLER\S-1-5-21-3403794038-735125100-868809978-1006\Dc22.wma Infected: Trojan-Downloader.WMA.GetCodec.b skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP201\A0029978.inf Infected: Worm.Win32.AutoRun.cub skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP201\A0029979.dll Infected: Trojan-PSW.Win32.OnLineGames.qyo skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP215\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_ZTE Proprietary USB Modem #2.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\JET859B.tmp Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users