Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page 1.reg virus again :(
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 10-06-2007, 06:18 AM   #1 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


1.reg virus again :(
Hi people,
I would like to ask you for one little help. I dont know how, but like 1 week ago i started to get this malware detection problem with Avast. I read some solutions here on TS, but it seems none of them works with me. Can you help me please?

my TJT log is:

Logfile of HijackThis v1.99.1
Scan saved at 14:19:21, on 6.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\scvhost32.exe
C:\WINDOWS\tsitra860.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Servant Salamander 2.0\salamand.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HJT\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft] scvhost32.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\tsitra860.exe 61A847B5BBF7281A349B284503996897C881250221C8670836AC4FA7C88332017491394661A64DB7C8F0287E55E246220D9E728F86C07B5670CA305072E744AB97
O4 - HKLM\..\RunServices: [Microsoft] scvhost32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190711763000
O17 - HKLM\System\CCS\Services\Tcpip\..\{9595F199-1DA7-4453-A920-894FC7690D52}: NameServer = 212.158.128.2,212.158.128.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 10-06-2007, 12:23 PM   #2 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
i did some work by myself, using Adware, Spybot SD, Panda online scan

the result is below:

Logfile of HijackThis v1.99.1
Scan saved at 20:22:13, on 6.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\tsitra860.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
C:\Program Files\Servant Salamander 2.0\salamand.exe
C:\Program Files\HJT\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft] scvhost32.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\tsitra860.exe 61A847B5BBF7281A349B284503996897C881250221C8670836AC4FA7C88332017491394661A64DB7C8F0287E55E246220D9E728F86C07B5670CA305072E744AB97
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190711763000
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9595F199-1DA7-4453-A920-894FC7690D52}: NameServer = 212.158.128.2,212.158.128.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-07-2007, 01:04 AM   #3 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------
  1. Download combofix.exe to your desktop. We'll use this shortly.
  2. Download SDFix and save it to your Desktop.
  3. Download ResetTeaTimer.bat by right-clicking on the link, and choosing Save As. Save it to your desktop, or somewhere you can find it easily.
    Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.
  4. Disconnect from the internet....pull the plug!
  5. S& D Spybot's Tea Timer

    While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
    Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
    • Open Spybot Search & Destroy.
    • In the Mode menu click "Advanced mode" if not already selected.
    • Choose "Yes" at the Warning prompt.
    • Expand the "Tools" menu.
    • Click "Resident".
    • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
    • In the File menu click "Exit" to exit Spybot Search & Destroy.
    • See this link for a tutorial

  6. Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)

  7. Please then reboot your computer in Safe Mode by doing the following :
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, the Advanced Options Menu should appear;
    • Select the first option, to run Windows in Safe Mode, then press Enter.
    • Choose your usual account.

    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    • Post that log, C:\SDFix\report.txt , in your next reply at the end of this fix.


    Once SDFix has finished it's routine, run ComboFix:

  9. Go to -> Run -> paste in the following single line command & click OK

    "%userprofile%\desktop\combofix.exe" /killall


  10. Type "1" and press Enter to begin the scan.
  11. When finished, it shall produce a log for you. Post that log in your next reply.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    ---------------------------------------------------------------------------------------------
  12. Re-enable your Anti-Virus if it is not active...a reboot should have re-activated it.
  13. Re-establish an internet connection.
  14. You are using an outdated version of HijackThis. Please uninstall from Add or Remove Programs, and then delete your current version.

    Next, download HijackThis to your desktop

    Alternate link

    This program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
    Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

    Upon install, HijackThis should open for you.

    Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

    1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
    2. If you don't get the intro screen, just hit Scan and then click on Save log.
    3. Please post a new log with the updated version.. Do not fix anything in HijackThis since they may be harmless.

    ---------------------------------------------------------------------------------------------

Post logs from:

SDFix (C:\SDFix\report.txt)
ComboFix (C:\ComboFix.txt)
HijackThis (version 2.0.2)
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-08-2007, 08:22 AM   #4 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
first - thank you for your help my friend

here are the logs:


SDFix: Version 1.107

Run by xxx on po 08.10.2007 at 15:23

Microsoft Windows XP [Verze 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\b122.exe - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Miranda IM\\miranda32.exe"="C:\\Program Files\\Miranda IM\\miranda32.exe:*:Enabled:Miranda IM"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5"
"C:\\Documents and Settings\\xxx\\Plocha\\semtel-1.0.1\\SemTel-bin\\SemTel32.exe"="C:\\Documents and Settings\\xxx\\Plocha\\semtel-1.0.1\\SemTel-bin\\SemTel32.exe:*:Enabled:SemTel32.exe"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Opera\\Opera.exe"="C:\\Program Files\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser"
"C:\\Documents and Settings\\xxx\\Plocha\\gggg\\StrongDC.exe"="C:\\Documents and Settings\\xxx\\Plocha\\gggg\\StrongDC.exe:*:Enabled:StrongDC++"
"C:\\Program Files\\StrongDC\\StrongDC.exe"="C:\\Program Files\\StrongDC\\StrongDC.exe:*:Enabled:StrongDC++"
"C:\\Program Files\\LDC++ 1.00 v2a-bin\\LDCPlusPlus.exe"="C:\\Program Files\\LDC++ 1.00 v2a-bin\\LDCPlusPlus.exe:*:Enabled:LDC++"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\\WINDOWS\\system32\\scvhost32.exe"="C:\\WINDOWS\\system32\\scvhost32.exe:*:Disabled:scvhost32"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 30 Sep 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 24 Jan 2006 8,647,680 A..H. --- "C:\_Dokumenty\FEL\!===BP===\~WRL2165.tmp"
Wed 20 Jun 2007 475,648 A..H. --- "C:\_Dokumenty\FEL\!!===Delft\FC\~WRL1058.tmp"
Wed 6 Jun 2007 19,968 A..H. --- "C:\_Dokumenty\FEL\!!===Delft\FC\~WRL3294.tmp"
Fri 15 Jun 2007 21,504 A..H. --- "C:\_Dokumenty\FEL\!!===Delft\FC\~WRL3301.tmp"
Sat 25 Aug 2007 770,560 A..H. --- "C:\_Dokumenty\FEL\!!===Delft\TAF\~WRL1487.tmp"
Sat 23 Jun 2007 782,336 A..H. --- "C:\_Dokumenty\FEL\!!===Delft\BME\__Final Paper\~WRL3433.tmp"

Finished!

ComboFix 07-10-08.3 - xxx 2007-10-08 16:08:16.1 - NTFSx86
Syst‚m Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.276 [GMT 2:00]
Running from: C:\Documents and Settings\xxx\Plocha\combofix.exe
Command switches used :: /killall
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-08 to 2007-10-08 )))))))))))))))))))))))))))))))
.

2007-10-08 16:07 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-08 15:21 <DIR> d-------- C:\WINDOWS\ERUNT
2007-10-06 20:05 <DIR> d-------- C:\Program Files\Comodo
2007-10-06 16:28 <DIR> d-------- C:\Program Files\Lavasoft
2007-10-06 16:23 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-06 16:00 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-10-06 15:49 <DIR> d-------- C:\Program Files\ie-spyad_zo
2007-10-06 14:43 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-10-06 13:51 <DIR> d-------- C:\WINDOWS\pss
2007-10-06 13:25 <DIR> d-------- C:\Program Files\HJT
2007-10-03 20:00 <DIR> d-------- C:\Program Files\Temporary
2007-10-03 19:56 35,840 -ra------ C:\WINDOWS\tsitra860.exe
2007-10-03 19:56 9,806 --a------ C:\WINDOWS\wrx10sf.exe
2007-10-03 09:24 <DIR> d-------- C:\Documents and Settings\xxx\.thumbnails
2007-10-03 09:19 <DIR> d-------- C:\Documents and Settings\xxx\.gimp-2.2
2007-10-03 09:18 <DIR> d-------- C:\Program Files\GIMP-2.0
2007-10-03 09:18 <DIR> d-------- C:\Program Files\Common Files\GTK
2007-10-02 18:48 <DIR> d-------- C:\Program Files\PartyGaming
2007-10-02 01:03 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-09-30 10:41 <DIR> d-------- C:\Program Files\Nero
2007-09-30 10:41 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-09-29 12:52 <DIR> d-------- C:\WinSPMBT
2007-09-29 12:42 <DIR> d-------- C:\Program Files\InstallShield Installation Information
2007-09-29 12:41 <DIR> d-------- C:\Program Files\PowerQuest
2007-09-28 20:26 <DIR> d-------- C:\Web
2007-09-28 20:24 <DIR> d-------- C:\TF
2007-09-28 17:37 132,864 -ra------ C:\WINDOWS\system32\drivers\Fasttx2k.sys
2007-09-28 15:34 <DIR> d-------- C:\Program Files\LDC++ 1.00 v2a-bin
2007-09-28 15:15 <DIR> d--h----- C:\WINDOWS\PIF
2007-09-28 14:22 <DIR> dr------- C:\_Dokumenty
2007-09-28 13:53 <DIR> d-------- C:\Program Files\Alwil Software
2007-09-28 13:53 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-09-28 13:53 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-09-28 13:53 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-09-28 13:53 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-09-28 13:53 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-28 13:53 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-28 13:53 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-28 13:53 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-09-28 13:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-27 19:39 <DIR> d-------- C:\Program Files\xp-AntiSpy
2007-09-27 19:03 <DIR> d-------- C:\Downloads
2007-09-27 19:03 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2007-09-27 19:01 <DIR> d-------- C:\Program Files\BitComet
2007-09-27 18:38 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-09-27 18:37 <DIR> d-------- C:\Program Files\Real
2007-09-27 18:37 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-09-27 18:37 <DIR> d-------- C:\Program Files\Common Files\Real
2007-09-27 18:28 <DIR> d-------- C:\temp\fuji_BIG
2007-09-27 18:28 <DIR> d-------- C:\temp\100_FUJI
2007-09-27 18:28 <DIR> d-------- C:\temp
2007-09-27 18:19 <DIR> d-------- C:\WINDOWS\PrimoPDF
2007-09-27 18:19 <DIR> d-------- C:\Program Files\activePDF
2007-09-27 18:19 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2007-09-27 10:43 <DIR> d-------- C:\Program Files\VideoLAN
2007-09-27 10:41 <DIR> d-------- C:\WINDOWS\system32\C2MP
2007-09-26 12:31 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-09-26 12:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-09-26 12:29 <DIR> dr-h----- C:\MSOCache
2007-09-26 12:27 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-09-26 12:26 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-09-26 12:20 <DIR> d-------- C:\Program Files\Servant Salamander 2.0
2007-09-26 12:10 <DIR> d-------- C:\Program Files\Celtx
2007-09-26 09:31 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-09-26 09:31 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-09-26 09:31 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-09-26 09:31 113 --a------ C:\WINDOWS\system32\zonedon.reg
2007-09-26 09:31 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2007-09-26 00:15 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-09-26 00:15 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-09-26 00:15 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-09-25 22:33 <DIR> d-------- C:\Program Files\SmartFTP Client
2007-09-25 22:19 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-09-25 17:02 <DIR> d-------- C:\Program Files\Skype
2007-09-25 17:02 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-09-25 16:52 <DIR> d-------- C:\Program Files\Miranda IM
2007-09-25 16:47 <DIR> d-------- C:\Program Files\Opera
2007-09-25 16:38 <DIR> d-------- C:\WINDOWS\nview
2007-09-25 16:38 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-09-25 16:37 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-09-25 16:36 <DIR> d-------- C:\Program Files\NVIDIA
2007-09-25 16:35 <DIR> d-------- C:\Documents and Settings\LocalService\Nabˇdka Start
2007-09-25 15:41 <DIR> d-------- C:\WINDOWS\provisioning
2007-09-25 15:41 <DIR> d-------- C:\WINDOWS\peernet
2007-09-25 15:41 6,807,328 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-09-25 15:41 6,807,328 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-09-25 15:41 5,690,624 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-09-25 15:41 5,690,624 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll
2007-09-25 15:41 2,927,616 --------- C:\WINDOWS\system32\xpsp2res.dll
2007-09-25 15:41 2,113,536 --------- C:\WINDOWS\system32\dxdiagn.dll
2007-09-25 15:41 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2007-09-25 15:41 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
2007-09-25 15:41 1,689,088 --------- C:\WINDOWS\system32\d3d9.dll
2007-09-25 15:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys
2007-09-25 15:41 1,116,160 --a------ C:\WINDOWS\system32\wmsdmoe2.dll
2007-09-25 15:41 1,116,160 --a--c--- C:\WINDOWS\system32\dllcache\wmsdmoe2.dll
2007-09-25 15:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2007-09-25 15:41 999,424 --a------ C:\WINDOWS\system32\wmvdmoe2.dll
2007-09-25 15:41 999,424 --a--c--- C:\WINDOWS\system32\dllcache\wmvdmoe2.dll
2007-09-25 15:41 936,960 --a------ C:\WINDOWS\system32\wmspdmoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-06 12:54 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-09-25 15:41 8972 --a------ C:\WINDOWS\PCHealth\HelpCtr\Config\Cntstore.bin
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-10-06 20:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 15:49]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 16:16]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
R3 usbhub;Ovladač standardního rozbočovače USB;C:\WINDOWS\system32\DRIVERS\usbhub.sys
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Schedule

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-08 16:10:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-08 16:11:24
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:20:14, on 8.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Servant Salamander 2.0\salamand.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190711763000
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9595F199-1DA7-4453-A920-894FC7690D52}: NameServer = 212.158.128.2,212.158.128.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7285 bytes

i hope its clean..
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-08-2007, 09:03 AM   #5 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
You're welcome for the help.

Looking much better, but more work to do.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/186196-1-reg-virus-again.html

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\\system32\scvhost32.exe"=-

Collect::
C:\WINDOWS\tsitra860.exe
C:\WINDOWS\wrx10sf.exe

DirLook::
C:\Program Files\Temporary
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-08-2007, 09:47 AM   #6 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
ComboFix 07-10-08.3 - xxx 2007-10-08 17:40:52.3 - NTFSx86
Syst‚m Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.285 [GMT 2:00]
Running from: C:\Documents and Settings\xxx\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\xxx\Plocha\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\tsitra860.exe
C:\WINDOWS\wrx10sf.exe

.
((((((((((((((((((((((((( Files Created from 2007-09-08 to 2007-10-08 )))))))))))))))))))))))))))))))
.

2007-10-08 16:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-08 16:07 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-08 15:21 <DIR> d-------- C:\WINDOWS\ERUNT
2007-10-06 20:05 <DIR> d-------- C:\Program Files\Comodo
2007-10-06 16:28 <DIR> d-------- C:\Program Files\Lavasoft
2007-10-06 16:23 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-06 16:00 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-10-06 15:49 <DIR> d-------- C:\Program Files\ie-spyad_zo
2007-10-06 14:43 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-10-06 13:51 <DIR> d-------- C:\WINDOWS\pss
2007-10-03 20:00 <DIR> d-------- C:\Program Files\Temporary
2007-10-03 09:24 <DIR> d-------- C:\Documents and Settings\xxx\.thumbnails
2007-10-03 09:19 <DIR> d-------- C:\Documents and Settings\xxx\.gimp-2.2
2007-10-03 09:18 <DIR> d-------- C:\Program Files\GIMP-2.0
2007-10-03 09:18 <DIR> d-------- C:\Program Files\Common Files\GTK
2007-10-02 18:48 <DIR> d-------- C:\Program Files\PartyGaming
2007-10-02 01:03 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-09-30 10:41 <DIR> d-------- C:\Program Files\Nero
2007-09-30 10:41 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-09-29 12:52 <DIR> d-------- C:\WinSPMBT
2007-09-29 12:42 <DIR> d-------- C:\Program Files\InstallShield Installation Information
2007-09-29 12:41 <DIR> d-------- C:\Program Files\PowerQuest
2007-09-28 20:26 <DIR> d-------- C:\Web
2007-09-28 20:24 <DIR> d-------- C:\TF
2007-09-28 17:37 132,864 -ra------ C:\WINDOWS\system32\drivers\Fasttx2k.sys
2007-09-28 15:34 <DIR> d-------- C:\Program Files\LDC++ 1.00 v2a-bin
2007-09-28 15:15 <DIR> d--h----- C:\WINDOWS\PIF
2007-09-28 14:22 <DIR> dr------- C:\_Dokumenty
2007-09-28 13:53 <DIR> d-------- C:\Program Files\Alwil Software
2007-09-28 13:53 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-09-28 13:53 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-09-28 13:53 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-09-28 13:53 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-09-28 13:53 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-28 13:53 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-28 13:53 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-28 13:53 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-09-28 13:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-27 19:39 <DIR> d-------- C:\Program Files\xp-AntiSpy
2007-09-27 19:03 <DIR> d-------- C:\Downloads
2007-09-27 19:03 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2007-09-27 19:01 <DIR> d-------- C:\Program Files\BitComet
2007-09-27 18:38 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-09-27 18:37 <DIR> d-------- C:\Program Files\Real
2007-09-27 18:37 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-09-27 18:37 <DIR> d-------- C:\Program Files\Common Files\Real
2007-09-27 18:28 <DIR> d-------- C:\temp\fuji_BIG
2007-09-27 18:28 <DIR> d-------- C:\temp\100_FUJI
2007-09-27 18:28 <DIR> d-------- C:\temp
2007-09-27 18:19 <DIR> d-------- C:\WINDOWS\PrimoPDF
2007-09-27 18:19 <DIR> d-------- C:\Program Files\activePDF
2007-09-27 18:19 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2007-09-27 10:43 <DIR> d-------- C:\Program Files\VideoLAN
2007-09-27 10:41 <DIR> d-------- C:\WINDOWS\system32\C2MP
2007-09-26 12:31 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-09-26 12:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-09-26 12:29 <DIR> dr-h----- C:\MSOCache
2007-09-26 12:27 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-09-26 12:26 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-09-26 12:20 <DIR> d-------- C:\Program Files\Servant Salamander 2.0
2007-09-26 12:10 <DIR> d-------- C:\Program Files\Celtx
2007-09-26 09:31 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-09-26 09:31 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-09-26 09:31 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-09-26 09:31 113 --a------ C:\WINDOWS\system32\zonedon.reg
2007-09-26 09:31 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2007-09-26 00:15 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-09-26 00:15 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2007-09-26 00:15 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2007-09-25 22:33 <DIR> d-------- C:\Program Files\SmartFTP Client
2007-09-25 22:19 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-09-25 17:02 <DIR> d-------- C:\Program Files\Skype
2007-09-25 17:02 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-09-25 16:52 <DIR> d-------- C:\Program Files\Miranda IM
2007-09-25 16:47 <DIR> d-------- C:\Program Files\Opera
2007-09-25 16:38 <DIR> d-------- C:\WINDOWS\nview
2007-09-25 16:38 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-09-25 16:37 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-09-25 16:36 <DIR> d-------- C:\Program Files\NVIDIA
2007-09-25 16:35 <DIR> d-------- C:\Documents and Settings\LocalService\Nabˇdka Start
2007-09-25 15:41 <DIR> d-------- C:\WINDOWS\provisioning
2007-09-25 15:41 <DIR> d-------- C:\WINDOWS\peernet
2007-09-25 15:41 6,807,328 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-09-25 15:41 6,807,328 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys
2007-09-25 15:41 5,690,624 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-09-25 15:41 5,690,624 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll
2007-09-25 15:41 2,927,616 --------- C:\WINDOWS\system32\xpsp2res.dll
2007-09-25 15:41 2,113,536 --------- C:\WINDOWS\system32\dxdiagn.dll
2007-09-25 15:41 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2007-09-25 15:41 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
2007-09-25 15:41 1,689,088 --------- C:\WINDOWS\system32\d3d9.dll
2007-09-25 15:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys
2007-09-25 15:41 1,116,160 --a------ C:\WINDOWS\system32\wmsdmoe2.dll
2007-09-25 15:41 1,116,160 --a--c--- C:\WINDOWS\system32\dllcache\wmsdmoe2.dll
2007-09-25 15:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2007-09-25 15:41 999,424 --a------ C:\WINDOWS\system32\wmvdmoe2.dll
2007-09-25 15:41 999,424 --a--c--- C:\WINDOWS\system32\dllcache\wmvdmoe2.dll
2007-09-25 15:41 936,960 --a------ C:\WINDOWS\system32\wmspdmoe.dll
2007-09-25 15:41 936,960 --a--c--- C:\WINDOWS\system32\dllcache\wmspdmoe.dll
2007-09-25 15:41 870,784 --------- C:\WINDOWS\system32\ati3d1ag.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-06 12:54 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-09-25 15:41 8972 --a------ C:\WINDOWS\PCHealth\HelpCtr\Config\Cntstore.bin
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))


---- Directory of C:\Program Files\Temporary ----

2007-10-03 20:00 46592 --a------ C:\Program Files\Temporary\wininstall.exe


((((((((((((((((((((((((((((( snapshot@2007-10-08_16.11.07,87 )))))))))))))))))))))))))))))))))))))))))
.
----atw 16,384 2007-10-08 15:37:13 C:\WINDOWS\Temp\Perflib_Perfdata_6e4.dat
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-10-06 20:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 15:49]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 16:16]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
R3 usbhub;Ovladač standardního rozbočovače USB;C:\WINDOWS\system32\DRIVERS\usbhub.sys
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\D:\NTGLM7X.sys
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Schedule

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-08 17:42:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-08 17:43:29
C:\ComboFix-quarantined-files.txt ... 2007-10-08 17:43
C:\ComboFix2.txt ... 2007-10-08 16:11
.
--- E O F ---

files sent
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-08-2007, 10:02 AM   #7 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
Good work, thanks.

Please delete this Folder:

C:\Program Files\Temporary

Let me know if it poses any problem.


Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-08-2007, 04:45 PM   #8 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
Tuesday, October 09, 2007 12:38:09 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 8/10/2007
Kaspersky Anti-Virus database records: 429266

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
F:\

Scan Statistics
Total number of scanned objects 62044
Number of viruses found 6
Number of infected objects 14
Number of suspicious objects 0
Duration of the scan process 05:03:51

Infected Object Name Virus Name Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\xxx\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\xxx\Data aplikací\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped

C:\Documents and Settings\xxx\Data aplikací\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped

C:\Documents and Settings\xxx\Data aplikací\Opera\Opera\mail\mailbase.dat Object is locked skipped

C:\Documents and Settings\xxx\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\xxx\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\xxx\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\xxx\Local Settings\Temp\~DF1C72.tmp Object is locked skipped

C:\Documents and Settings\xxx\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\xxx\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\xxx\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\xxx\Plocha\[4]-Submit_2007-10-08@17.25.zip/tsitra860.exe Infected: Trojan-Downloader.Win32.Agent.dve skipped

C:\Documents and Settings\xxx\Plocha\[4]-Submit_2007-10-08@17.25.zip/wrx10sf.exe Infected: Email-Worm.Win32.Zhelatin.kb skipped

C:\Documents and Settings\xxx\Plocha\[4]-Submit_2007-10-08@17.25.zip ZIP: infected - 2 skipped

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped

C:\SDFix\backups\backups.zip/backups/b122.exe Infected: Trojan-Downloader.Win32.Agent.dpn skipped

C:\SDFix\backups\backups.zip ZIP: infected - 1 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{3361C36F-DDA9-43F1-9617-0CC217C232EC}\RP4\A0001107.exe Infected: Trojan.Win32.Agent.bqn skipped

C:\System Volume Information\_restore{3361C36F-DDA9-43F1-9617-0CC217C232EC}\RP4\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_6e4.dat Object is locked skipped

C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO/docs/Maillist/All_In_One.zip/mail0005.txt/[From Po-Tai Cheng ][Date Thu, 4 May 2000 18:04:14 +0800]/LOVE-LETTER-FOR-YOU.TXT.vbs Infected: Email-Worm.VBS.LoveLetter skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO/docs/Maillist/All_In_One.zip/mail0005.txt Infected: Email-Worm.VBS.LoveLetter skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO/docs/Maillist/All_In_One.zip/mail9705.txt/[From "Tomas Hasman Ing.CSc. K315" ][Date Mon, 5 May 1997 20:02:13 MET-1MEST]/Adres.doc Infected: Virus.MSWord.Concept skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO/docs/Maillist/All_In_One.zip/mail9705.txt Infected: Virus.MSWord.Concept skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO/docs/Maillist/All_In_One.zip Infected: Virus.MSWord.Concept skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO/docs/Maillist/mail0005.txt/[From Po-Tai Cheng ][Date Thu, 4 May 2000 18:04:14 +0800]/LOVE-LETTER-FOR-YOU.TXT.vbs Infected: Email-Worm.VBS.LoveLetter skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO/docs/Maillist/mail0005.txt Infected: Email-Worm.VBS.LoveLetter skipped

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO Infected: Email-Worm.VBS.LoveLetter skipped

Scan process completed.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:44:01, on 9.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Servant Salamander 2.0\salamand.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190711763000
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9595F199-1DA7-4453-A920-894FC7690D52}: NameServer = 212.158.128.2,212.158.128.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7109 bytes


Deleting C:\Program Files\Temporary no problems
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-08-2007, 04:57 PM   #9 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
These items are reported to be infected with the email worm, LoveLetter:

C:\_Dokumenty\FEL\ATP\EEUG_ATP2005.ISO
C:\_Dokumenty\FEL\ATP\EEUG_ATP2005

Recommend you delete them.

These files/folders are no longer needed, and can be deleted:

C:\Documents and Settings\xxx\Plocha\[4]-Submit_2007-10-08@17.25.zip <<<I assume you've replaced your computer user account name with "xxx" here

C:\SDFix\backups

Please go to Start > Run and copy/paste the following command, then press Enter:

ComboFix /u

Report back on how all that went, please.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-09-2007, 04:18 AM   #10 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
it went all ok

everything is deleted

but there is still something in the Sys volume information and the system does not allow me to browse that folder
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-09-2007, 08:41 AM   #11 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
Combofix /u should have reset System Restore points, which is what System Volume Information is.

Is something alerting to an infection in that location?

If so, manually reset System Restore points again.

CLEAR & RESET SYSTEM RESTORE'S CACHE

Go to Start >> Run - type or copy/paste control sysdm.cpl,,4 & press Enter

* Tick on the checkbox - Turn off System Restore on all drives
* Click Apply

Turn it back 'On' by unticking the same checkbox & click Apply, and then OK

---------------------------------------------------------------------------------------------

Other than that.....



Your logs appear clean.You should be good to go. We still have a few items to address.


Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you don't have them already:
  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • SpywareGuard to catch and block spyware before it can execute.
  • SPYBOT - SEARCH & DESTROY
    Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here

    IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
    See this link for a listing of some online antivirus scanners:

    Anti-Spyware Tutorial
  • FIREWALL
    If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:

    Do not install more than one firewall program because they will conflict with each other.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-09-2007, 09:21 AM   #12 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
System restore is disabled, i noticed the information from the Kaspersky result, but that was before and it is solved now.

I would like to thank you for your effort, this was really an experience for me, i learned a lot!
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-09-2007, 10:09 AM   #13 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
Hi chaindler -

You're quite welcome.

Just want to make sure you've re-enabled System Restore. It's an important fallback position to have.

That said, a more comprehensive registry backup program is ERUNT.

http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

Read more about it here:

http://www.larshederer.homepage.t-online.de/erunt/

And here:

http://wiki.castlecops.com/User:PCBr...ry_Maintenance
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-09-2007, 04:55 PM   #14 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
thanks, i will check it up!
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-09-2007, 05:13 PM   #15 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
Cheers.

So, System Restore is enabled, correct?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-10-2007, 04:47 AM   #16 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 11
OS: XP SP2


Re: 1.reg virus again :(
Yes, i used the Erunt, nice tool
chaindler is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 10-10-2007, 08:55 AM   #17 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,196
OS: 2000 Pro; XP Pro; XP Home


Re: 1.reg virus again :(
Excellent. Thanks for the feedback.

Happy computing, and Safe Surfing to you.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 03:48 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85