|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-04-2007, 05:23 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2007
Location: London
Posts: 15
OS: Vista 32bit Business Edition
|
[SOLVED] alot of viruses that heal and then reappear
Hey, guys, my pc recently started accumulating alot of viruses, but avg seems to "heal" them only until the next scan.
I've heard alot about hijack this and Im not sure this will help, but its worth a try. Heres my hijack-this log: Code:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 00:19:24, on 05-Jul-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\VPN Client\VPN Client\cvpnd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\program Files\team MediaPortal\MediaPortal\mptray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Windows Desktop Search\WindowsSearchIndexer.exe
C:\Program Files\Styler\Styler.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Grisoft\AVG Anti-Rootkit Free\avgarkt.exe
C:\Program Files\Grisoft\AVG Anti-Rootkit Free\urNMfnLJs.exe
D:\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: (no name) - {4562809F-1A90-4981-B16F-6073A362D4B6} - C:\WINDOWS\system32\nyhebvni.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8392A8A7-4886-481F-B945-650207D618A2} - C:\WINDOWS\system32\opnnljj.dll (file missing)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {C81AB74A-178B-42FE-B0D9-DA2A0C111ECC} - C:\WINDOWS\system32\jkklk.dll (file missing)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\win67.tmp.exe
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MediaPortal Shell] C:\program Files\team MediaPortal\MediaPortal\mptray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Styler.lnk = ?
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = D:\cs3\Installation\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Append to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.windowsvistatestdrive.com/ActiveX/VMRCActiveXClient1.cab
O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: ebfefbbacfdddb - C:\WINDOWS\system32\ebfefbbacfdddb.dll
O20 - Winlogon Notify: notifyc - C:\WINDOWS\system32\clk.dll (file missing)
O20 - Winlogon Notify: opnnljj - opnnljj.dll (file missing)
O20 - Winlogon Notify: wincqt32 - C:\WINDOWS\SYSTEM32\wincqt32.dll
O20 - Winlogon Notify: winwil32 - winwil32.dll (file missing)
O21 - SSODL: LDpswSend - {71EC5123-28DF-324A-D76B-32549AB4C338} - C:\WINDOWS\system32\Aadadi32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: (no name) - {AF0BE91A-D92D-44F5-9581-64F629762E5A} - C:\WINDOWS\system32\clk.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\VPN Client\VPN Client\cvpnd.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
--
End of file - 11210 bytes
btw, also, my pc started to restart when waken from sleep... this happend recently also, mayb this will be fixed too with your solutions well, Thanks in advance... Dipun |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-05-2007, 03:40 PM
|
#3 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: alot of viruses that heal and then reappear
1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
07-05-2007, 04:04 PM
|
#4 (permalink) |
|
Registered User
Join Date: Jul 2007
Location: London
Posts: 15
OS: Vista 32bit Business Edition
|
Re: alot of viruses that heal and then reappear
ok....
that was weird, I hope I aint messsed things up. The program was saying that it was nearly finished and that it was gonna leave a log in c:\combofix.txt... but it was a c:\combofix.txt.bat: Code:
@call "C:\ComboFix\setpath.bat" call "C:\ComboFix\Find3M.bat" now its got a new content: "Dipun Mistry" - 2007-07-05 22:44:23 - ComboFix 07-07-06 - Service Pack 2 (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\wincqt32.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ALLUSE~1\APPLIC~1.\TEMP C:\DOCUME~1\DIPUNM~1\Desktop\internet.lnk C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe C:\WINDOWS\system32\_000111_.tmp.dll C:\WINDOWS\system32\_000115_.tmp.dll C:\WINDOWS\system32\drivers\sfsync02.sys C:\WINDOWS\system32\ebfefbbacfdddb.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_NM -------\LEGACY_NPF -------\LEGACY_SFSYNC02 -------\asc3550u -------\nm -------\sfsync02 ((((((((((((((((((((((((( Files Created from 2007-06-05 to 2007-07-05 ))))))))))))))))))))))))))))))) 2007-07-05 22:49 0 --a------ C:\WINDOWS\system32\sfsync02.dll 2007-07-05 22:43 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-05 22:01 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-07-05 00:47 <DIR> d-------- C:\Downloads 2007-07-05 00:47 <DIR> d-------- C:\DOCUME~1\DIPUNM~1\APPLIC~1\GetRightToGo 2007-07-05 00:40 <DIR> d-------- C:\Program Files\G-Lock Software 2007-07-05 00:02 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys 2007-07-04 12:11 28,672 --a------ C:\WINDOWS\system32\syswin.exe 2007-07-03 23:39 <DIR> d-------- C:\Program Files\MultipleIEs 2007-07-02 20:10 <DIR> d-------- C:\DOCUME~1\DIPUNM~1\.netbeans 2007-07-02 19:51 7,680 --a------ C:\WINDOWS\system32\Aadadi32.dll 2007-07-02 19:51 10,240 --a------ C:\hivtvru.exe 2007-07-02 19:51 0 --a------ C:\WINDOWS\Sysvxd.exe 2007-07-02 17:51 <DIR> d-------- C:\Program Files\netbeans-5.5.1 2007-07-02 16:17 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll 2007-07-02 16:17 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe 2007-07-02 01:03 <DIR> d-------- C:\Program Files\Cavaj Java Decompiler 2007-07-02 01:01 80 -r-hs---- C:\WINDOWS\system32\9DC3AF0B31.dll 2007-07-02 01:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Protexis 2007-07-02 00:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-06-22 18:53 <DIR> d-------- C:\Program Files\Joost 2007-06-13 09:28 106,496 --a------ C:\WINDOWS\system32\GenDMOProp.dll 2007-06-10 09:54 <DIR> d-------- C:\Program Files\iTunes 2007-06-10 09:54 <DIR> d-------- C:\Program Files\iPod 2007-06-09 16:31 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-06-09 16:31 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-02 19:02:18 3,450 ----a-w C:\WINDOWS\mozver.dat 2007-07-02 18:51:20 -------- d-----w C:\Program Files\UberIcon 2007-07-02 17:49:39 -------- d-----w C:\Program Files\Microsoft ActiveSync 2007-07-02 17:42:45 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\uTorrent 2007-07-02 16:55:23 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-02 16:55:22 -------- d-----w C:\Program Files\NVidia Corporation 2007-07-02 15:52:47 -------- d-----w C:\Program Files\QuickTime 2007-07-02 15:05:27 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-07-02 14:04:39 -------- d-----w C:\Program Files\Tribler 2007-06-10 08:55:59 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Apple Computer 2007-06-10 08:45:23 -------- d-----w C:\Program Files\Apple Software Update 2007-06-09 15:36:05 -------- d-----w C:\Program Files\Thoosje Vista Sidebar v1.7.8 2007-05-31 11:00:26 -------- d-----w C:\Program Files\SEPY ActionScript Editor 2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll 2007-05-26 08:33:06 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Nokia 2007-05-26 07:48:29 -------- d-----w C:\Program Files\Google 2007-05-26 07:22:15 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Nokia Multimedia Player 2007-05-24 17:12:38 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\SAPIEN 2007-05-24 17:11:02 -------- d-----w C:\Program Files\Common Files\SAPIEN Common 2007-05-24 17:11:01 -------- d-----w C:\Program Files\Common Files\Wintertree 2007-05-24 17:10:59 -------- d-----w C:\Program Files\SAPIEN 2007-05-23 04:26:21 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\.Tribler 2007-05-22 22:09:57 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\vlc 2007-05-22 19:50:20 -------- d-----w C:\Program Files\ffdshow 2007-05-22 10:14:24 -------- d-----w C:\Program Files\Common Files\Nokia 2007-05-22 10:14:21 -------- d-----w C:\Program Files\Nokia 2007-05-22 10:10:53 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\PC Suite 2007-05-22 07:21:05 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-05-22 07:11:52 -------- d-----w C:\Program Files\DIFX 2007-05-22 07:07:26 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-05-22 07:03:03 -------- d-----w C:\Program Files\PC Connectivity Solution 2007-05-22 06:20:26 -------- d-----w C:\Program Files\QuickTime Alternative 2007-05-22 05:28:59 -------- d-----w C:\Program Files\CoreCodec 2007-05-22 05:13:15 -------- d-----w C:\Program Files\WinFast 2007-05-22 05:02:03 -------- d-----w C:\Program Files\directx 2007-05-20 15:47:08 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\DeskSoft 2007-05-20 15:43:49 -------- d-----w C:\Program Files\Qemu 2007-05-20 15:38:34 -------- d-----w C:\Program Files\RAR Password Cracker 2007-05-20 15:35:48 -------- d-----w C:\Program Files\Tunebite 2007-05-20 15:34:15 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\tunebite 2007-05-20 15:33:46 -------- d-----w C:\Program Files\URLSnooper2 2007-05-17 17:27:44 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Joost 2007-05-16 21:18:37 -------- d-----w C:\Program Files\MSN Messenger 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-05-16 00:04:22 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-05-15 17:38:53 -------- d-----w C:\Program Files\Common Files\Control Panels 2007-05-15 16:50:59 -------- d-----w C:\Program Files\Bonjour 2007-05-15 16:42:09 -------- d-----w C:\Program Files\Common Files\Macrovision Shared 2007-05-15 00:53:05 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\DivX 2007-05-14 22:45:10 -------- d-----w C:\Program Files\BitTyrant 2007-05-14 22:45:10 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\BitTyrant 2007-05-13 21:58:09 -------- d-----w C:\Program Files\FreeIPTV 2007-05-13 21:17:34 -------- d-----w C:\Program Files\Hauppauge MediaMVP 2007-05-11 22:34:08 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Notepad++ 2007-05-11 21:11:00 -------- d-----w C:\Program Files\Notepad++ 2007-05-11 20:23:58 123,082 ----a-w C:\WINDOWS\HPHins12.dat 2007-05-11 18:59:22 -------- d-----w C:\Program Files\HP 2007-05-11 01:59:51 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Eltima Software 2007-05-11 01:58:41 -------- d-----w C:\Program Files\Eltima Software 2007-05-09 18:02:01 -------- d-----w C:\Program Files\Common Files\Stardock 2007-05-09 18:01:46 -------- d-----w C:\Program Files\Stardock 2007-05-09 17:37:49 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-05-09 12:18:53 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Google 2007-05-08 19:23:10 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-05-08 01:23:09 -------- d-----w C:\Program Files\Styler 2007-05-08 00:36:34 -------- d-----w C:\Program Files\WinCustomize 2007-05-07 20:20:05 -------- d-----w C:\Program Files\WinAce 2007-05-03 15:31:59 5,689,344 ----a-w C:\Program Files\mplayerc.exe 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-24 16:30:28 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 00:15:24 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-04-23 00:15:24 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2007-04-23 00:15:24 116,472 ------w C:\WINDOWS\system32\pxcpyi64.exe 2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-04-19 10:23:36 148,992 ----a-w C:\WINDOWS\system32\nsesetup.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 21:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 21:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 21:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 21:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 21:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 21:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 21:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 21:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-16 21:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-16 21:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F85D76C-0569-466F-A488-493E6BD0E955}] 2006-03-26 23:44 265432 --------- C:\Program Files\Windows Desktop Search\dsWebAllow.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] 2006-10-22 23:20 321120 --a------ D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-26 00:26] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14:36 C:\WINDOWS\RTHDCPL.EXE] "Alcmtr"="ALCMTR.EXE" [2005-05-03 19:43 C:\WINDOWS\ALCMTR.EXE] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48] "UltraMon"="C:\Program Files\UltraMon\UltraMon.exe" [2006-10-12 22:27] "LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-05-26 08:48] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51] "Acrobat Assistant 8.0"="D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24] "@"="" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "MediaPortal Shell"="C:\program Files\team MediaPortal\MediaPortal\mptray.exe" [2006-09-22 09:57] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{AF0BE91A-D92D-44F5-9581-64F629762E5A}"="C:\WINDOWS\system32\clk.dll" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 15:13] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"="C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 14:11] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}"="C:\Program Files\Common Files\Stardock\MCPCore.dll" [2003-10-20 13:30] "{71EC5123-28DF-324A-D76B-32549AB4C338}"="C:\WINDOWS\system32\Aadadi32.dll" [2007-07-02 19:51] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] C:\Program Files\Common Files\Stardock\mcpstub.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnnljj] opnnljj.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winwil32] winwil32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] "D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BestAlarmClock] C:\Program Files\Best AlarmClock\BestAlarmClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup] rundll32.exe "C:\WINDOWS\system32\mjaknmnm.dll",realset [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] AutoRun\command- J:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] AutoRun\command- K:\RunGame.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{083450cc-632b-11d5-9a5e-ca1dc6149a73}] AutoRun\command- G:\LaunchU3.exe Contents of the 'Scheduled Tasks' folder 2007-06-10 06:07:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-05 22:52:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-05 22:55:16 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-05 22:55 --- E O F --- and heres C:\ComboFix-quarantined-files.txt: 2004-08-04 13:00 2804224 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\_000111_.tmp.dll.vir 2004-08-04 13:00 44032 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\_000115_.tmp.dll.vir 2004-12-03 11:20 20544 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\sfsync02.sys.vir 2006-12-09 23:16 104 --a------ C:\Qoobox\Quarantine\C\DOCUME~1\DIPUNM~1\Desktop\Internet.lnk.vir 2007-07-02 19:51 20480 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\wincqt32.dll.vir 2007-07-04 22:15 40183 --a------ C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1162OinUninstaller.exe.vir 2007-07-05 22:49 1302 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_NM.reg.cf 2007-07-05 22:49 1488 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_SFSYNC02.reg.cf 2007-07-05 22:49 17632 --a------ C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf 2007-07-05 22:49 2572 --a------ C:\Qoobox\Quarantine\Registry_backups\services_sfsync02.reg.cf 2007-07-05 22:49 276 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_NPF.reg.cf 2007-07-05 22:49 780 --a------ C:\Qoobox\Quarantine\Registry_backups\services_asc3550u.reg.cf 2007-07-05 22:50 178 --a------ C:\Qoobox\Quarantine\catchme.log 2007-07-05 22:50 20021 --a------ C:\Qoobox\Quarantine\catchme2007-07-05_225235.42.zip 2007-07-05 22:50 23040 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ebfefbbacfdddb.dll.vir Folder PATH listing for volume XP Volume serial number is C436-D9FD C:\QOOBOX \---Quarantine | catchme.log | catchme2007-07-05_225235.42.zip | +---C | +---DOCUME~1 | | \---DIPUNM~1 | | \---Desktop | | Internet.lnk.vir | | | +---Program Files | | \---Common Files | | Yazzle1162OinUninstaller.exe.vir | | | \---WINDOWS | \---system32 | | ebfefbbacfdddb.dll.vir | | wincqt32.dll.vir | | _000111_.tmp.dll.vir | | _000115_.tmp.dll.vir | | | \---drivers | sfsync02.sys.vir | \---Registry_backups LEGACY_NM.reg.cf LEGACY_NPF.reg.cf LEGACY_SFSYNC02.reg.cf services_asc3550u.reg.cf services_nm.reg.cf services_sfsync02.reg.cf [/code] and heres a fresh hijack log: [code]Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 23:04:18, on 05-Jul-2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\VPN Client\VPN Client\cvpnd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\vmnat.exe C:\WINDOWS\system32\vmnetdhcp.exe C:\Program Files\Common Files\Stardock\SDMCP.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Desktop Search\wds_sl.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\UltraMon\UltraMon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\iTunes\iTunesHelper.exe D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\program Files\team MediaPortal\MediaPortal\mptray.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Styler\Styler.exe C:\Program Files\Windows Desktop Search\WindowsSearchIndexer.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE D:\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MediaPortal Shell] C:\program Files\team MediaPortal\MediaPortal\mptray.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Styler.lnk = ? O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = D:\cs3\Installation\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: Append to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.windowsvistatestdrive.com/ActiveX/VMRCActiveXClient1.cab O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: opnnljj - opnnljj.dll (file missing) O20 - Winlogon Notify: winwil32 - winwil32.dll (file missing) O21 - SSODL: LDpswSend - {71EC5123-28DF-324A-D76B-32549AB4C338} - C:\WINDOWS\system32\Aadadi32.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: (no name) - {AF0BE91A-D92D-44F5-9581-64F629762E5A} - C:\WINDOWS\system32\clk.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\VPN Client\VPN Client\cvpnd.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe -- End of file - 10483 bytes Last edited by sUBs; 07-05-2007 at 11:06 PM. |
|
|
|
|
07-05-2007, 11:26 PM
|
#5 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: alot of viruses that heal and then reappear
Before fixing anything, open notepad and Copy/Paste the text in the box below into it:
Code:
edited  Double click on Submit.bat & allow it to generate a zipped file called Submit [Date Time].zip Please submit this file to ? http://www.bleepingcomputer.com/subm....php?channel=4 The file must be uploaded before proceeding to the next step. --------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O20 - Winlogon Notify: opnnljj - opnnljj.dll (file missing) O20 - Winlogon Notify: winwil32 - winwil32.dll (file missing) O21 - SSODL: LDpswSend - {71EC5123-28DF-324A-D76B-32549AB4C338} - C:\WINDOWS\system32\Aadadi32.dll O22 - SharedTaskScheduler: (no name) - {AF0BE91A-D92D-44F5-9581-64F629762E5A} - C:\WINDOWS\system32\clk.dll (file missing) --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
File::
C:\WINDOWS\system32\sfsync02.dll
C:\WINDOWS\system32\syswin.exe
C:\WINDOWS\system32\Aadadi32.dll
C:\hivtvru.exe
C:\WINDOWS\Sysvxd.exe
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF0BE91A-D92D-44F5-9581-64F629762E5A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{71EC5123-28DF-324A-D76B-32549AB4C338}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnnljj]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winwil32]
 Refering to the picture above, drag CFScript into ComboFix.exe Then post the resultant log --------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? Last edited by sUBs; 01-16-2009 at 10:18 PM. |
|
|
|
|
07-06-2007, 03:22 PM
|
#6 (permalink) |
|
Registered User
Join Date: Jul 2007
Location: London
Posts: 15
OS: Vista 32bit Business Edition
|
Re: alot of viruses that heal and then reappear
ok, Ive uploaded the zip to the website... um, I dont know how you can access it, it was given a comment "for sUBs" and is called "Submit [06-Jul-2007 12.52.37.14].zip"
oh, n i suppose that it has a linkback to this post.  (i forgot seeing that ive left the scan for basically the whole day, cancelling first time cos i thought it was taking way too long) comboFix's Log: "Dipun Mistry" - 2007-07-06 13:05:01 - ComboFix 07-07-06 - Service Pack 2 Command switches used :: D:\CFScript.txt ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\hivtvru.exe C:\WINDOWS\system32\Aadadi32.dll C:\WINDOWS\system32\sfsync02.dll C:\WINDOWS\system32\syswin.exe C:\WINDOWS\Sysvxd.exe ((((((((((((((((((((((((( Files Created from 2007-06-06 to 2007-07-06 ))))))))))))))))))))))))))))))) 2007-07-05 22:43 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-05 22:01 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-07-05 00:47 <DIR> d-------- C:\Downloads 2007-07-05 00:47 <DIR> d-------- C:\DOCUME~1\DIPUNM~1\APPLIC~1\GetRightToGo 2007-07-05 00:40 <DIR> d-------- C:\Program Files\G-Lock Software 2007-07-05 00:02 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys 2007-07-03 23:39 <DIR> d-------- C:\Program Files\MultipleIEs 2007-07-02 20:10 <DIR> d-------- C:\DOCUME~1\DIPUNM~1\.netbeans 2007-07-02 17:51 <DIR> d-------- C:\Program Files\netbeans-5.5.1 2007-07-02 16:17 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll 2007-07-02 16:17 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe 2007-07-02 01:03 <DIR> d-------- C:\Program Files\Cavaj Java Decompiler 2007-07-02 01:01 80 -r-hs---- C:\WINDOWS\system32\9DC3AF0B31.dll 2007-07-02 01:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Protexis 2007-07-02 00:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-06-22 18:53 <DIR> d-------- C:\Program Files\Joost 2007-06-13 09:28 106,496 --a------ C:\WINDOWS\system32\GenDMOProp.dll 2007-06-10 09:54 <DIR> d-------- C:\Program Files\iTunes 2007-06-10 09:54 <DIR> d-------- C:\Program Files\iPod 2007-06-09 16:31 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-06-09 16:31 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-02 19:02:18 3,450 ----a-w C:\WINDOWS\mozver.dat 2007-07-02 18:51:20 -------- d-----w C:\Program Files\UberIcon 2007-07-02 17:49:39 -------- d-----w C:\Program Files\Microsoft ActiveSync 2007-07-02 17:42:45 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\uTorrent 2007-07-02 16:55:23 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-02 16:55:22 -------- d-----w C:\Program Files\NVidia Corporation 2007-07-02 15:52:47 -------- d-----w C:\Program Files\QuickTime 2007-07-02 15:05:27 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-07-02 14:04:39 -------- d-----w C:\Program Files\Tribler 2007-06-10 08:55:59 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Apple Computer 2007-06-10 08:45:23 -------- d-----w C:\Program Files\Apple Software Update 2007-06-09 15:36:05 -------- d-----w C:\Program Files\Thoosje Vista Sidebar v1.7.8 2007-05-31 11:00:26 -------- d-----w C:\Program Files\SEPY ActionScript Editor 2007-05-31 06:45:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2007-05-31 06:44:55 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-05-31 06:44:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-05-31 06:44:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-05-31 06:44:54 740,442 ----a-w C:\WINDOWS\system32\DivX.dll 2007-05-26 08:33:06 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Nokia 2007-05-26 07:48:29 -------- d-----w C:\Program Files\Google 2007-05-26 07:22:15 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Nokia Multimedia Player 2007-05-24 17:12:38 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\SAPIEN 2007-05-24 17:11:02 -------- d-----w C:\Program Files\Common Files\SAPIEN Common 2007-05-24 17:11:01 -------- d-----w C:\Program Files\Common Files\Wintertree 2007-05-24 17:10:59 -------- d-----w C:\Program Files\SAPIEN 2007-05-23 04:26:21 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\.Tribler 2007-05-22 22:09:57 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\vlc 2007-05-22 19:50:20 -------- d-----w C:\Program Files\ffdshow 2007-05-22 10:14:24 -------- d-----w C:\Program Files\Common Files\Nokia 2007-05-22 10:14:21 -------- d-----w C:\Program Files\Nokia 2007-05-22 10:10:53 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\PC Suite 2007-05-22 07:21:05 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-05-22 07:11:52 -------- d-----w C:\Program Files\DIFX 2007-05-22 07:07:26 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-05-22 07:03:03 -------- d-----w C:\Program Files\PC Connectivity Solution 2007-05-22 06:20:26 -------- d-----w C:\Program Files\QuickTime Alternative 2007-05-22 05:28:59 -------- d-----w C:\Program Files\CoreCodec 2007-05-22 05:13:15 -------- d-----w C:\Program Files\WinFast 2007-05-22 05:02:03 -------- d-----w C:\Program Files\directx 2007-05-20 15:47:08 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\DeskSoft 2007-05-20 15:43:49 -------- d-----w C:\Program Files\Qemu 2007-05-20 15:38:34 -------- d-----w C:\Program Files\RAR Password Cracker 2007-05-20 15:35:48 -------- d-----w C:\Program Files\Tunebite 2007-05-20 15:34:15 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\tunebite 2007-05-20 15:33:46 -------- d-----w C:\Program Files\URLSnooper2 2007-05-17 17:27:44 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Joost 2007-05-16 21:18:37 -------- d-----w C:\Program Files\MSN Messenger 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-05-16 00:04:22 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-05-15 17:38:53 -------- d-----w C:\Program Files\Common Files\Control Panels 2007-05-15 16:50:59 -------- d-----w C:\Program Files\Bonjour 2007-05-15 16:42:09 -------- d-----w C:\Program Files\Common Files\Macrovision Shared 2007-05-15 00:53:05 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\DivX 2007-05-14 22:45:10 -------- d-----w C:\Program Files\BitTyrant 2007-05-14 22:45:10 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\BitTyrant 2007-05-13 21:58:09 -------- d-----w C:\Program Files\FreeIPTV 2007-05-13 21:17:34 -------- d-----w C:\Program Files\Hauppauge MediaMVP 2007-05-11 22:34:08 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Notepad++ 2007-05-11 21:11:00 -------- d-----w C:\Program Files\Notepad++ 2007-05-11 20:23:58 123,082 ----a-w C:\WINDOWS\HPHins12.dat 2007-05-11 18:59:22 -------- d-----w C:\Program Files\HP 2007-05-11 01:59:51 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Eltima Software 2007-05-11 01:58:41 -------- d-----w C:\Program Files\Eltima Software 2007-05-09 18:02:01 -------- d-----w C:\Program Files\Common Files\Stardock 2007-05-09 18:01:46 -------- d-----w C:\Program Files\Stardock 2007-05-09 17:37:49 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-05-09 12:18:53 -------- d-----w C:\DOCUME~1\DIPUNM~1\APPLIC~1\Google 2007-05-08 19:23:10 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-05-08 01:23:09 -------- d-----w C:\Program Files\Styler 2007-05-08 00:36:34 -------- d-----w C:\Program Files\WinCustomize 2007-05-07 20:20:05 -------- d-----w C:\Program Files\WinAce 2007-05-03 15:31:59 5,689,344 ----a-w C:\Program Files\mplayerc.exe 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-24 16:30:28 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 00:15:24 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-04-23 00:15:24 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2007-04-23 00:15:24 116,472 ------w C:\WINDOWS\system32\pxcpyi64.exe 2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-04-19 10:23:36 148,992 ----a-w C:\WINDOWS\system32\nsesetup.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 21:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 21:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 21:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 21:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 21:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 21:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 21:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 21:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-16 21:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-16 21:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F85D76C-0569-466F-A488-493E6BD0E955}] 2006-03-26 23:44 265432 --------- C:\Program Files\Windows Desktop Search\dsWebAllow.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] 2006-10-22 23:20 321120 --a------ D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-26 00:26] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14:36 C:\WINDOWS\RTHDCPL.EXE] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48] "UltraMon"="C:\Program Files\UltraMon\UltraMon.exe" [2006-10-12 22:27] "LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-05-26 08:48] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51] "Acrobat Assistant 8.0"="D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24] "@"="" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "MediaPortal Shell"="C:\program Files\team MediaPortal\MediaPortal\mptray.exe" [2006-09-22 09:57] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 15:13] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"="C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 14:11] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}"="C:\Program Files\Common Files\Stardock\MCPCore.dll" [2003-10-20 13:30] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] C:\Program Files\Common Files\Stardock\mcpstub.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] "D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BestAlarmClock] C:\Program Files\Best AlarmClock\BestAlarmClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup] rundll32.exe "C:\WINDOWS\system32\mjaknmnm.dll",realset [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] AutoRun\command- J:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] AutoRun\command- K:\RunGame.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{083450cc-632b-11d5-9a5e-ca1dc6149a73}] AutoRun\command- G:\LaunchU3.exe *Newly Created Service* - CATCHME Contents of the 'Scheduled Tasks' folder 2007-06-10 06:07:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-06 13:09:13 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-06 13:10:14 C:\ComboFix-quarantined-files.txt ... 2007-07-06 13:10 C:\ComboFix2.txt ... 2007-07-05 22:55 --- E O F --- if you want: C:\ComboFix-quarantined-files.txt ... 2007-07-06 13:10 C:\ComboFix2.txt ... 2007-07-05 22:55 they are attached virus report: Total number of scanned files: 185648 Number of viruses found: 16 Number of infected objects: 74 Number of suspicious objects: 0 Duration of the scan process: 05:42:11 ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, July 06, 2007 10:08:32 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 6/07/2007 Kaspersky Anti-Virus database records: 359000 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 185648 Number of viruses found: 16 Number of infected objects: 74 / 0 Number of suspicious objects: 0 Duration of the scan process: 05:42:11 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\VMware\vmnetdhcp.leases Object is locked skipped C:\Documents and Settings\Dipun Mistry\Application Data\Microsoft\Internet Explorer\UserData\index.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\GatherLogs\MyIndex\MyIndex.75.Crwl Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\GatherLogs\MyIndex\MyIndex.75.gthr Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\00010003.ci Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\00010012.ci Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\CiPT0000.000 Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\INDEX.000 Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\NlFiles\CiST0000.000 Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\NlFiles\DocId.Map Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.chk1.gthr Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.chk2.gthr Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Ntfy302.gthr Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\MSS.log Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\MSStmp.log Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\RSApp.edb Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\tmp.edb Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Logs\MAPI.txt Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Temp\rssgthrsvc\Ntf1.tmp Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Temp\rssgthrsvc\Ntf2.tmp Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Desktop Search\Temp\rssgthrsvc\Perflib_Perfdata_a48.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\History\History.IE5\MSHist012007070620070707\index.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Temp\amt.log Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Temp\hsperfdata_Dipun Mistry\964 Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Temp\~DF546.tmp Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Temp\~DF59E.tmp Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Temp\~DF8B1D.tmp Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\ntuser.dat Object is locked skipped C:\Documents and Settings\Dipun Mistry\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Dipun Mistry\Submit [06-Jul-2007 12.52.37.14].zip/syswin.exe Infected: Trojan-Downloader.Win32.Alphabet.c skipped C:\Documents and Settings\Dipun Mistry\Submit [06-Jul-2007 12.52.37.14].zip/Aadadi32.dll Infected: Trojan-Downloader.Win32.Agent.bxd skipped C:\Documents and Settings\Dipun Mistry\Submit [06-Jul-2007 12.52.37.14].zip/hivtvru.exe Infected: Trojan-Downloader.Win32.Agent.bxd skipped C:\Documents and Settings\Dipun Mistry\Submit [06-Jul-2007 12.52.37.14].zip ZIP: infected - 3 skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Adobe\Adobe PCD\cache\cache.db Object is locked skipped C:\Program Files\Common Files\Adobe\Adobe PCD\pcd.db Object is locked skipped C:\Program Files\Common Files\Adobe\caps\caps.db Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\wincqt32.dll.vir Infected: Trojan.Win32.Dialer.qn skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/IMNames.exe Infected: not-a-virus:AdWare.Win32.2Search.h skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.g skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/1.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/1.exe/data.rar/uninstall.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/1.exe/data.rar/get.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/1.exe/data.rar/2search.dll Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/1.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar/1.exe Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103468.exe RarSFX: infected - 9 skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/IMNames.exe Infected: not-a-virus:AdWare.Win32.2Search.h skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.g skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/1.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/1.exe/data.rar/uninstall.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/1.exe/data.rar/get.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/1.exe/data.rar/2search.dll Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/1.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar/1.exe Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103474.exe RarSFX: infected - 9 skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103477.exe/stream/data0008 Infected: not-a-virus:AdWare.Win32.Comet.ay skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103477.exe/stream Infected: not-a-virus:AdWare.Win32.Comet.ay skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP188\A0103477.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP199\A0105205.exe Infected: Trojan-Dropper.Win32.Agent.bln skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP199\A0105206.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP199\A0106205.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP199\A0107205.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP199\A0107217.exe Infected: Trojan-Downloader.Win32.Alphabet.c skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0108205.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0108217.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0109205.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0110205.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0110219.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0110234.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ku skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0110235.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ku skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0111219.sys Infected: Trojan-Proxy.Win32.Agent.mx skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP200\A0111239.exe Infected: Trojan-Downloader.Win32.Alphabet.gen skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP201\A0112260.dll Infected: Trojan.Win32.Dialer.qn skipped C:\System Volume Information\_restore{72F68FA5-64A8-4970-B41F-48AF3F741AA1}\RP201\change.log Object is locked skipped C:\VundoFix Backups\jkklk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\VundoFix Backups\rawtdoqn.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\CloseApp.exe Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/IMNames.exe Infected: not-a-virus:AdWare.Win32.2Search.h skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.g skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/1.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/1.exe/data.rar/uninstall.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/1.exe/data.rar/get.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/1.exe/data.rar/2search.dll Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/1.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar/1.exe Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe RarSFX: infected - 9 skipped D:\BackupHomePC\Amishalogin stuff\Desktop\weather_dir.exe/stream/data0008 Infected: not-a-virus:AdWare.Win32.Comet.ay skipped D:\BackupHomePC\Amishalogin stuff\Desktop\weather_dir.exe/stream Infected: not-a-virus:AdWare.Win32.Comet.ay skipped D:\BackupHomePC\Amishalogin stuff\Desktop\weather_dir.exe NSIS: infected - 2 skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/IMNames.exe Infected: not-a-virus:AdWare.Win32.2Search.h skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.g skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/1.exe/data.rar/main.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/1.exe/data.rar/uninstall.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/1.exe/data.rar/get.exe Infected: not-a-virus:AdWare.Win32.2Search.c skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/1.exe/data.rar/2search.dll Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/1.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar/1.exe Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe/data.rar Infected: not-a-virus:AdWare.Win32.2Search.f skipped D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe RarSFX: infected - 9 skipped D:\My Downloads\VisionZero___Core_Release_3_by_da_flow\Tweaks\Toggle LogOff-Start Button Text Patch.exe/WISE0004.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped D:\My Downloads\VisionZero___Core_Release_3_by_da_flow\Tweaks\Toggle LogOff-Start Button Text Patch.exe WiseSFX: infected - 1 skipped D:\My Downloads\VisionZero___Core_Release_3_by_da_flow.zip/Tweaks/Toggle LogOff-Start Button Text Patch.exe/WISE0004.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped D:\My Downloads\VisionZero___Core_Release_3_by_da_flow.zip/Tweaks/Toggle LogOff-Start Button Text Patch.exe Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped D:\My Downloads\VisionZero___Core_Release_3_by_da_flow.zip ZIP: infected - 2 skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. [/code] new hijack: [code]Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 22:17:58, on 06-Jul-2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\VPN Client\VPN Client\cvpnd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\vmnat.exe C:\WINDOWS\system32\vmnetdhcp.exe C:\Program Files\Common Files\Stardock\SDMCP.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Desktop Search\wds_sl.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\UltraMon\UltraMon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\iTunes\iTunesHelper.exe D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\program Files\team MediaPortal\MediaPortal\mptray.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Styler\Styler.exe C:\Program Files\Windows Desktop Search\WindowsSearchIndexer.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Notepad++\notepad++.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\NOTEPAD.EXE D:\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\cs3\Installation\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MediaPortal Shell] C:\program Files\team MediaPortal\MediaPortal\mptray.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Styler.lnk = ? O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = D:\cs3\Installation\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: Append to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://D:\cs3\Installation\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - http://www.windowsvistatestdrive.com/ActiveX/VMRCActiveXClient1.cab O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\VPN Client\VPN Client\cvpnd.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe -- End of file - 10186 bytes well, i just did a standby and it didnt restart upon wakeup, although, until these viruses are gone, i dont think ill try it again. PC is a little more responsive but Ive just started my antivirus again so in respect to that i cant tell u much more. virus scan took quite a while. Last edited by sUBs; 07-06-2007 at 03:49 PM. |
|
|
|
|
07-06-2007, 03:54 PM
|
#7 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: alot of viruses that heal and then reappear
Open notepad and copy/paste the text in the quotebox below into it:
Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\Dipun Mistry\Submit [06-Jul-2007 12.52.37.14].zip" "D:\BackupHomePC\Amishalogin stuff\Desktop\IM-Names.exe" "D:\BackupHomePC\Amishalogin stuff\Desktop\weather_dir.exe" "D:\BackupHomePC\Amishalogin stuff\My Documents\bhavesh mama\IM-Names.exe" ) do ( del /a/f %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) for %%g in ( "C:\VundoFix Backups" C:\QooBox ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Delete Successfully !! nircmd wait 7000 del %0 It should look like this: Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Question - what have you done for the community today? |
|
|
|
|
07-06-2007, 04:02 PM
|
#9 (permalink) | |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: alot of viruses that heal and then reappear
Quote:
Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
|
|
07-06-2007, 04:13 PM
|
#10 (permalink) |
|
Registered User
Join Date: Jul 2007
Location: London
Posts: 15
OS: Vista 32bit Business Edition
|
Re: alot of viruses that heal and then reappear
Tick - Hide file extensions for known types
i have done everything on the list except the above... i dont see how this can effect my security and i like to see my file extensions as well as modify them in some occasions (eg, uploading zip files to my friends) I will install all above now aswell if it is a scurity risk, let me know |
|
|
|
|
07-06-2007, 04:19 PM
|
#11 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Re: [SOLVED] alot of viruses that heal and then reappear
It's okay if you wanna leave extensions unhidden. It was a preventive measure to avoid accidental renaming of file extensions.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
