Other than a lot of rebooting and shutting down on it's own. The computer seems to be operating like normal. It has been like this since my Symantec antivirus quarantined the file and partially dealt with the 33[1].exe file.
1. Fresh HijackThis logfile.
A- {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -
http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {9C196458-4145-46AF-8A77-1506878DFECA} (FirstClass?Control) -
http://fcis.oise.utoronto.ca/ClientD...s/fcplugin.cab
O18 - Protocol: fcp - {B3133379-8789-4D3C-9593-C205D7297501} - C:\WINDOWS\Downloaded Program Files\fcplugin.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
2) Online Scanner
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, August 27, 2007 6:35:24 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 27/08/2007
Kaspersky Anti-Virus database records: 392939
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
Scan Statistics:
Total number of scanned objects: 46609
Number of viruses found: 2
Number of infected objects: 48
Number of suspicious objects: 0
Duration of the scan process: 01
17
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\MSLEO.INF Infected: Trojan-PSW.Win32.OnLineGames.aim skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\temp\ZLT00c7c.TMP Object is locked skipped
C:\WINDOWS\temp\ZLT00c93.TMP Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\MELODY.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{EFDD7072-A7D8-4031-AB74-4F960B73F892}.bin Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-08-27_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Melody Li\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Melody Li\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Melody Li\Local Settings\Temp\~DFF734.tmp Object is locked skipped
C:\Documents and Settings\Melody Li\Start Menu\Programs\Startup\OFFICE 翑忒.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped
C:\Documents and Settings\Melody Li\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\parent.lock Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\history.dat Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\cert8.db Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\key3.db Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Melody Li\Application Data\MailFrontier\ASD.log Object is locked skipped
C:\Documents and Settings\Melody Li\.rainlendar2\rainlendar2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0951NAV~.TMP Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0379NAV~.TMP Object is locked skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024347.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024363.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP28\A0025545.DLL Infected: Trojan-PSW.Win32.OnLineGames.aim skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025705.EXE Infected: Virus.Win32.AutoRun.f skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025706.EXE Infected: Virus.Win32.AutoRun.f skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025707.com Infected: Virus.Win32.AutoRun.f skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\change.log Object is locked skipped
C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\A0025743.EXE Infected: Trojan-PSW.Win32.OnLineGames.aim skipped
D:\oblipto.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP18\A0017217.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017610.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017620.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017632.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017669.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0017683.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0020699.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021710.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021725.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021749.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021757.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021768.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021786.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP19\A0021805.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP20\A0021882.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0021920.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0021938.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0022951.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0022985.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0022995.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0023052.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0023100.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0023113.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0024113.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0024132.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP21\A0024150.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024215.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024227.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024253.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024262.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP22\A0024273.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024337.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP23\A0024356.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP24\A0024403.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP25\A0024431.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP25\A0024441.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP25\A0024450.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP27\A0024500.exe Infected: Virus.Win32.AutoRun.f skipped
D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP29\change.log Object is locked skipped
Scan process completed.
3) ComboFix log
ComboFix 07-08-26.3 - "Melody Li" 2007-08-27 3:11:25.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.950.886.1033.18.65 [GMT -4:00]
Command switches used :: C:\Documents and Settings\Melody Li\Desktop\CFScript.txt
* Created a new restore point
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\msconfig.dll
C:\WINDOWS\system32\MSCONFIG.DLL
C:\WINDOWS\system32\sexit.dat
((((((((((((((((((((((((( Files Created from 2007-07-27 to 2007-08-27 )))))))))))))))))))))))))))))))
2007-08-27 04:12 512 --a------ C:\ScanSectorLog.dat
2007-08-27 03:58 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-08-27 03:58 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-08-27 03:58 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-08-27 03:58 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-08-27 03:58 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-27 03:58 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-08-27 03:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-27 03:27 <DIR> d--hs---- C:\FOUND.002
2007-08-27 03:24 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-17 07:52 <DIR> d-------- C:\Program Files\ParaUSB
2007-08-17 07:52 <DIR> d-------- C:\Program Files\MFLPRO
2007-08-13 18:07 <DIR> d--hs---- C:\FOUND.001
2007-08-13 13:56 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-08-13 13:56 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-08-13 13:53 <DIR> d-------- C:\Program Files\Picasa2
2007-08-13 13:53 <DIR> d-------- C:\Program Files\Google
2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2007-08-10 14:20 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-08-08 23:14 <DIR> d-------- C:\Program Files\Help
2007-08-08 10:45 1,277 --a------ C:\WINDOWS\mozver.dat
2007-08-03 13:12 <DIR> d-------- C:\Program Files\Symantec AntiVirus
2007-08-03 11:22 <DIR> d-------- C:\Program Files\SymNetDrv
2007-08-01 14:56 <DIR> d-------- C:\Program Files\FirstClass
2007-08-01 12:11 <DIR> d--hs---- C:\FOUND.000
2007-07-30 09:21 <DIR> d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Inspiration Software
2007-07-27 23:27 <DIR> d-------- C:\WINDOWS\speech
2007-07-27 23:26 <DIR> d-------- C:\Program Files\Inspiration 8 IE
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-27 03:17 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll
2007-07-24 14:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FirstClass
2007-07-17 14:38 --------- d-------- C:\Program Files\MSXML 4.0
2007-07-17 14:14 --------- d-------- C:\Program Files\Rainlendar2
2007-07-17 11:39 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\AdobeUM
2007-07-17 09:49 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Opera
2007-07-17 00:50 --------- d-------- C:\Program Files\MSN Messenger
2007-07-17 00:47 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Talkback
2007-07-16 21:07 --------- d-------- C:\Program Files\DivX
2007-07-16 21:07 --------- d-------- C:\Program Files\DefilerPak
2007-07-16 21:03 --------- d-------- C:\Program Files\Common Files\Ahead
2007-07-16 21:03 --------- d-------- C:\Program Files\Ahead
2007-07-16 20:55 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-07-16 20:55 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
2007-07-12 22:15 --------- d-------- C:\Program Files\Microsoft Works
2007-07-12 22:09 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
---- Directory of C:\Program Files\Help ----
2007-08-27 03:19 61 --a------ C:\Program Files\Help\backups\backup-20070827-031909-510
2007-08-27 03:19 61 --a------ C:\Program Files\Help\backups\backup-20070827-031909-443
2007-08-27 03:05 31 --a------ C:\Program Files\Help\backups\backup-20070827-030542-661
2007-08-27 03:05 10378 --a------ C:\Program Files\Help\hijackthis.log
2005-02-16 11:06 218112 --a------ C:\Program Files\Help\HelpMe.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2005-05-12 00:15]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-07 20:02]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 19:59]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-07 20:03]
"ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2003-09-19 12:54]
"Wireless Console"="C:\Program Files\ASUS\Wireless Console\wcourier.exe" [2005-06-20 19:16]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 14:46 C:\WINDOWS\KHALMNPR.Exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-12-21 23:23]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-12-21 23:23]
"SoundMan"="SOUNDMAN.EXE" [2005-01-05 00:40 C:\WINDOWS\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2005-01-05 00:02 C:\WINDOWS\ALCWZRD.EXE]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2004-09-21 16:55]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 11:27]
"EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2004-10-15 11:31]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 20:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-08-03 13:14]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 19:26]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-15 19:15]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-04-15 02:31]
C:\DOCUME~1\MELODY~1\STARTM~1\PROGRAMS\STARTUP\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54]
OFFICE 翑忒.EXE [2007-08-27 03:31:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-10-15 11:27 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
R0 risdptsk;risdptsk;C:\WINDOWS\system32\DRIVERS\risdptsk.sys
R3 Cam5603D;ASUS Mobile Vision Camera W5-A01;C:\WINDOWS\system32\Drivers\BisonCam.sys
S3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-08-27 03:28:55
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-27 3:34:38 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-27 03:34
C:\ComboFix2.txt ... 2007-08-27 03:38
--- E O F ---