1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

after cleaning up my pc, I still have pop-ups

Discussion in 'Windows - Virus and spyware problems' started by ska123, Apr 2, 2007.

Page 1 of 2
  1. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Hi everyone,
    I ran ad-aware, spybot, win32delfkil, & smitRem but I still get alot of pop-ups.
    These pop-ups started when I recently use a site to find air-fare.
    One time I even hear a radio/tv music station on my speakers when no programs were running on my pc...freaky

    Anyways here's my HJ log and I was hoping someone can help me out

    Thanks

    Ska
    ----------------------------------------------------------------

    Logfile of HijackThis v1.99.1
    Scan saved at 10:12:47 PM, on 4/2/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {bb16f469-49fd-4e43-a889-72b4b5e2d9f4} - C:\WINDOWS\system32\appeng.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://download.pplive.com/webinstall/install.CAB
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://skahung.spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - AppInit_DLLs:
    O20 - Winlogon Notify: appeng - C:\WINDOWS\SYSTEM32\appeng.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
     
    ska123, Apr 2, 2007
    #1
  2. KotaGuy

    KotaGuy Regular member

    Joined:
    Feb 14, 2007
    Messages:
    485
    Likes Received:
    0
    Trophy Points:
    26
    Please download VundoFix.exe to your desktop.

    [*]Double-click VundoFix.exe to run it.
    [*]Click the Scan for Vundo button.
    [*]Once it's done scanning, click the Remove Vundo button.
    [*]You will receive a prompt asking if you want to remove the files, click YES
    [*]Once you click yes, your desktop will go blank as it starts removing Vundo.
    [*]When completed, it will prompt that it will reboot your computer, click OK.
    [*]Please post the contents of C:\vundofix.txt and a new HiJackThis log.

    Note: It is possible that VundoFix encountered a file it could not remove.
    In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
     
    KotaGuy, Apr 2, 2007
    #2
  3. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Here is the VundoFix Txt and new HJ log...thanks

    -------------------------------------------------------
    VundoFix V6.3.19

    Checking Java version...

    Scan started at 6:20:11 PM 4/3/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\tmpC.tmp.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\tmpC.tmp.dll
    C:\WINDOWS\system32\tmpC.tmp.dll Has been deleted!

    Performing Repairs to the registry.
    Done!
    --------------------------------------------------------------
    Logfile of HijackThis v1.99.1
    Scan saved at 6:28:32 PM, on 4/3/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\adirss.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\adirka.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\Explorer.EXE
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O2 - BHO: Shell Doc Object and Control Helper Class - {00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000} - C:\WINDOWS\system32\shdocvs.dll
    O2 - BHO: Shell Event Object Class - {00534B55-3155-CA4F-B41D-0E922121D03C} - C:\WINDOWS\system32\cscentfy.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {bb16f469-49fd-4e43-a889-72b4b5e2d9f4} - C:\WINDOWS\system32\appeng.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run
    O4 - HKLM\..\Run: [sysinter] C:\WINDOWS\system32\adirss.exe
    O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\xxxvts.dll",setvm
    O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [adirka] C:\WINDOWS\system32\adirka.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'rsvp32_2.dll' missing
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://download.pplive.com/webinstall/install.CAB
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://skahung.spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - AppInit_DLLs:
    O20 - Winlogon Notify: appeng - C:\WINDOWS\SYSTEM32\appeng.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe




     
    ska123, Apr 3, 2007
    #3
  4. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    things are worst...my PC keeps on shutting down
     
    ska123, Apr 3, 2007
    #4
  5. Bobby728

    Bobby728 Member

    Joined:
    Mar 13, 2007
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    16
    Try to boot in safe mode.And look for any awanted programs that might have been installed.Hope you have a recovery disk?What type of POP UPS are you getting?It sounds like your Windows\system32 file was deleted.
     
    Last edited: Apr 3, 2007
    Bobby728, Apr 3, 2007
    #5
  6. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    System keeps shutting down after I deleted this malware
    "C:\WINDOWS\system32\tmpC.tmp.dll"

    Oh No......
     
    ska123, Apr 3, 2007
    #6
  7. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    should I do "system restore" ???
     
    ska123, Apr 3, 2007
    #7
  8. KotaGuy

    KotaGuy Regular member

    Joined:
    Feb 14, 2007
    Messages:
    485
    Likes Received:
    0
    Trophy Points:
    26
    Not yet.

    Vundofix deleting that dll shouldn't have caused the shutdown issue.

    How often are the shutdowns happening? When are they happening? And are you getting any kind of error messages? If so... can you tell me exactly what they are please.

    Print this out for reference during the fix as you wil be booting into Safe Mode and won't be able to access this site.

    For now download SDFix and save it to your Desktop.

    Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)

    Please then reboot your computer in Safe Mode by doing the following :

    [*] Restart your computer
    [*] After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    [*] Instead of Windows loading as normal, the Advanced Options Menu should appear;
    [*] Select the first option, to run Windows in Safe Mode, then press Enter.
    [*] Choose your usual account.
    [*] Open the extracted SDFix folder and double click RunThis.bat to start the script.
    [*] Type Y to begin the cleanup process.
    [*] It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    [*] Press any Key and it will restart the PC.
    [*] When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    [*] Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    [*] Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

    Thanks.
     
    KotaGuy, Apr 3, 2007
    #8
  9. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    the shut down is very random and I do get some kind of system message/error....but is so fast that I can not remember what it says.

    here are the new logs
    ----------------------------------------------------------------------
    SDFix: Version 1.76

    Run by Administrator - Tue 04/03/2007 - 21:38:34.34

    Microsoft Windows XP [Version 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:

    Name:
    wincom32

    ImagePath:
    \??\C:\WINDOWS\system32\wincom32.sys

    wincom32 Deleted


    Restoring Windows Registry Entries
    Restoring Default Hosts File

    Reset AppInit_DLLs value


    Rebooting...

    Normal Mode:
    Checking Files:

    Below files will be copied to Backups folder then removed:

    C:\WINDOWS\SYSTEM32\SYST555.DLL - Deleted
    C:\WINDOWS\SYSTEM32\PFB0E0~1.DLL - Deleted
    C:\WINDOWS\SYSTEM32\PFCA7F~1.DLL - Deleted
    C:\WINDOWS\SYSTEM32\SFXZMT~1.DLL - Deleted
    C:\WINDOWS\SYSTEM32\SFXZMT~2.DLL - Deleted
    C:\WINDOWS\SYSTEM32\SFXZMT~3.DLL - Deleted
    C:\WINDOWS\SYSTEM32\SFXZMT~4.DLL - Deleted
    C:\WINDOWS\system32\latest.exe.exe - Deleted
    C:\WINDOWS\system32\ma.exe.exe - Deleted
    C:\WINDOWS\system32\pep.exe.exe - Deleted
    C:\WINDOWS\system32\zoom.exe.exe - Deleted
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp9.tmp.exe - Deleted
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpA.tmp.exe - Deleted
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpC.tmp.exe - Deleted
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\abc123.pid - Deleted
    C:\a.bat - Deleted
    C:\WINDOWS\system32\adirka.dll - Deleted
    C:\WINDOWS\system32\adirka.exe - Deleted
    C:\WINDOWS\system32\adirss.exe - Deleted
    C:\WINDOWS\system32\comcbx2.dll - Deleted
    C:\WINDOWS\system32\comcs32c.dll - Deleted
    C:\WINDOWS\system32\commnet8.dll - Deleted
    C:\WINDOWS\system32\defrasw.dll - Deleted
    C:\WINDOWS\system32\dsuiexq.dll - Deleted
    C:\WINDOWS\system32\hnetviw.dll - Deleted
    C:\WINDOWS\system32\shdocvs.dll - Deleted
    C:\WINDOWS\system32\srvswc2.dll - Deleted
    C:\WINDOWS\system32\svcp.csv - Deleted
    C:\WINDOWS\system32\wincom32.ini - Deleted
    C:\WINDOWS\system32\wincom32.sys - Deleted
    C:\WINDOWS\system32\winsub.xml - Deleted



    ADS Check:

    C:\WINDOWS\system32
    No streams found.


    Final Check:

    Remaining Services:
    ------------------



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
    "C:\\Program Files\\Steam\\SteamApps\\skahung123@yahoo.com\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\skahung123@yahoo.com\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
    "C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\dmx18.tmp"="C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\dmx18.tmp:*:Enabled:enable"
    "C:\\WINDOWS\\sachostx.exe"="C:\\WINDOWS\\sachostx.exe:*:Enabled:enable"
    "C:\\WINDOWS\\system32\\sachostw.exe"="C:\\WINDOWS\\system32\\sachostw.exe:*:Enabled:enable"
    "C:\\WINDOWS\\system32\\sachosts.exe"="C:\\WINDOWS\\system32\\sachosts.exe:*:Enabled:enable"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
    "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
    "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
    "C:\\WINDOWS\\system32\\smt.exe"="C:\\WINDOWS\\system32\\smt.exe:*:Enabled:enable"
    "C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Enabled:enable"
    "C:\\WINDOWS\\system32\\adirss.exe"="C:\\WINDOWS\\system32\\adirss.exe:*:Enabled:enable"


    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"


    Remaining Files:
    ---------------
    C:\WINDOWS\system32\rsvp32_2.dll Found - LSP!

    Backups Folder: - C:\SDFix\backups\backups.zip

    Checking For Files with Hidden Attributes :

    C:\Program Files\Steam\SteamApps\skahung123@yahoo.com\counter-strike\cstrike\radial.cdb
    C:\WINDOWS\system\svchost.dll
    C:\WINDOWS\system32\tmp_35b.exe
    C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

    Finished
    --------------------------------------------------------------------
    Logfile of HijackThis v1.99.1
    Scan saved at 9:45:15 PM, on 4/3/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O2 - BHO: Shell Event Object Class - {00534B55-3155-CA4F-B41D-0E922121D03C} - C:\WINDOWS\system32\cscentfy.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {bb16f469-49fd-4e43-a889-72b4b5e2d9f4} - C:\WINDOWS\system32\appeng.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run
    O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\xxxvts.dll",setvm
    O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'rsvp32_2.dll' missing
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://download.pplive.com/webinstall/install.CAB
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://skahung.spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: appeng - C:\WINDOWS\SYSTEM32\appeng.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


     
    ska123, Apr 3, 2007
    #9
  10. KotaGuy

    KotaGuy Regular member

    Joined:
    Feb 14, 2007
    Messages:
    485
    Likes Received:
    0
    Trophy Points:
    26
    OK... been doing a bit of research into this... gonna take a bit more to do to get your machine fully clean.

    Though you have a Vundo infection(which we will take care of later)... the main nasty is the nuwar worm. Can be a pain to get rid of. Follow my next instructions carefully as I will be giving you a bit to do.

    Print this out for reference during the fix please.

    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Don't run it yet.

    Download AVG Anti-Spyware to your Desktop or to your usual Download Folder.

    [*]Install AVG Anti-Spyware by double clicking the installer.
    [*]Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
    [*]On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
    • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

      Don't scan with it yet.

      Download Lspfix. Extract(unzip) it to its own folder. Disconnect from the internet, and close all browser windows. Run LSPFix. Click the "I know what I'm doing" button. In the left hand pane, hilite all instances of rsvp32_2.dll (and nothing else), move them to the "Remove" pane and by clicking the >> button. Click Finish. Reboot to complete the process.

      Please reboot your computer in Safe Mode by doing the following :
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, the Advanced Options Menu should appear;
    • Select the first option, to run Windows in Safe Mode, then press Enter.
    • Choose your usual account.
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).

      Run and scan with HijackThis and place checks beside the following:

      O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe

      Close all open browsers/windows and click the Fix button.

      Double-click ATF Cleaner.exe to open it.

      Under Main choose:

      Windows Temp
      Current User Temp
      All Users Temp
      Cookies
      Temporary Internet Files
      Prefetch
      Java Cache

      *The other boxes are optional*

      Then click the Empty Selected button.

      For Firefox:

      Click Firefox at the top and choose: Select All
      Click the Empty Selected button.

      NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

      For Opera:

      Click Opera at the top and choose: Select All
      Click the Empty Selected button.

      NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

      Click Exit on the Main menu to close the program.

      Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
    • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
    • All checkboxes should be ticked.
    • Under Possibly unwanted software:
    • All checkboxes should be ticked.
    • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
    • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.

      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)

      [​IMG]
    • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

      Please do an online scan with Kaspersky WebScanner

      Click on Kaspersky Online Scanner

      You will be promted to install an ActiveX component from Kaspersky,
      Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:

      Extended (if available otherwise Standard)
    • Scan Options:

      Scan Archives Scan Mail Bases
    • Click OK
    • Now under select a target to scan:

      Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
    • Save the file to your desktop.

      Post the contents of Report.txt, the Kaspersky scan log, the AVG log and a new HijackThis log please.
     
    Last edited: Apr 3, 2007
    KotaGuy, Apr 3, 2007
    #10
  11. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 12:31:49 AM 4/4/2007

    + Scan result:



    HKLM\SOFTWARE\Classes\CLSID\{05936A67-40A0-A0D5-9587-1B76477FEA8B} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{1321EF49-6B5C-04F9-66D4-F25BB941C72B} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{15EAF32F-E910-66D5-9145-A0FEDA5A8A51} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{19912599-316F-1849-BEE2-88BC0F03A2F6} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{1A3AAC53-69B3-F769-1199-284A99589CE9} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{1F49118B-CE28-E736-9A74-BB3462551B2C} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{2275995B-15F0-C2B0-07AC-7736536CD351} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{29148831-1BE6-96DE-8759-B6F97A0EE29D} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{315E32CB-195A-8536-EB55-7CF4CDA121F2} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{3430DBD7-FB8E-89AC-570B-BFD4FF9822B6} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{3961D259-E678-4571-8985-CC45A0FEBCF4} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{3C169779-22CF-8A81-F177-94D7AD1DC71D} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{3D027C22-8D2B-4A94-D0FD-46C7FE851825} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{4008C656-FF3C-2255-1708-8543B85E668E} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{461AE737-3B83-63AB-9348-0DE2E0FE7E7E} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{461EF4B4-D11B-5B7D-49A7-C7710D453C73} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{4C5872DC-452E-B4E4-D79D-4343168E8B05} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{4D32057E-3515-B39C-BB3C-2DA7E2D53A22} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{4F741BC8-6979-4FC7-8956-2B6322868176} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{5061A3C6-884B-9AB8-F5E1-55D04DEAF516} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{52FEDAFD-7116-8034-52FF-C710EA25905B} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{56CEBCF1-61DF-21E9-D514-D3171D072D49} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{58FA652E-5652-D824-47C4-529AA453941E} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{59F75F0D-E0B2-3675-7DCE-9D9C175F169F} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{60366101-11CA-FC95-A7E1-2607FF9ABD7A} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{64B26103-2B1C-551B-4BBE-4C0B592B4757} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{6522CC06-085B-0152-B86B-5DEFD59319F2} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{655963E8-0F03-5868-828A-091DBC963461} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{6824A214-2563-7589-241D-2D4CB796330F} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{6EB6A56A-4BFC-3BA9-232B-8316BEE8CB76} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{7174FA43-6EAE-0B62-2831-9FFAA3A3EAFE} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{72ECE5A9-522C-6F23-EC15-D01F1BA43087} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{732A6990-9E44-5A09-2D9B-0AF21E8677FA} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{770CE589-D47C-9567-46F4-E4E08B3366BC} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{790066A1-58C7-6A3E-EDD2-1EC115CFF1A9} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{79261F79-8B9D-6D55-B257-7FE60D809E68} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{827DC7EF-FD7D-5875-3957-9E5201F23209} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{88204317-4193-5465-3672-D014877AA017} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{8A8F47B1-61ED-1CBB-2DB3-D81BFA6E22BF} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{8BD22483-B6F6-B378-D9E4-B6288EDCEC51} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{9571F3B6-7065-9679-8B28-911A24D61A15} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{95910D88-5B54-A5C5-10A9-C5AD58D4CB50} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{9B7B8469-5DD6-2CC3-6510-338DE167588F} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{A1A6E0B2-9F35-611E-2878-D85479FCA2FC} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{A1C73BCE-2717-B663-CA1A-1A4AA4AC5C4F} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{A8E16681-A711-EC17-988E-F3ADD4D9D6F8} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{AE65210B-2870-3EC4-9658-261BE1153BB2} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{AEAC41FA-E8BD-B13D-EE1F-5C3661E7CF47} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{B310DD57-6C72-BFC7-079E-1B118AFE7CB6} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{B7B31397-93FC-5ABD-5E72-3C4626580399} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{B83B6C5A-DF9A-BD8F-62B4-D3D04A46633B} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{BB89D6CC-E122-D820-6D84-036A8D4E2E6C} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{BD9CF1BA-C149-7FD6-0BF4-CE2A97CF0E4F} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{BDCDCF86-0104-CBA7-ED84-5A0E99292AC5} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{BE40D43B-1323-AC09-FD3D-F5F0CEEAF506} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{C448539A-1A24-DCB9-3152-D2DCA94E1831} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{CE894740-E436-0855-44E1-DB1DD21DEAD2} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{CE8C95DF-A478-EE5C-E911-BE35E557C173} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{CEBAD012-13C4-4D24-410D-C7155144CF79} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{CF5405A2-4593-3340-58C9-D8197B57070C} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{D848EBCF-F0F1-13F3-AC75-ED90BB56391A} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{DD47B787-CAC4-F520-61BA-E29B0061D1C7} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{DEEC4F78-64BF-6F57-27B8-B374376510B7} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{DF6C88D3-FA3F-481B-70C2-BD5213D346AF} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{E118C993-3E95-588B-3737-DEFDC8EAC743} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{E448F4D7-E1C0-5DD7-704C-D549F9DCA327} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{E7E40E04-9CBA-8F0C-C943-6791199E07B6} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{E9657FD2-2FA2-A768-AE41-168F3181BC64} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{EE5E8D85-5C41-AEAB-016D-094F74F518E8} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{F1433B90-7710-35CD-1D3D-FD488534F671} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{F3A0E4F7-5A26-16D7-F285-82AF755C81E0} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{F3E64CB7-708D-2920-9CEA-26BD849FC729} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{F4B4FBD7-AC73-6514-57E2-B85681F800B5} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{F8D004EB-8B02-BABB-8F18-55896F7BCE67} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\CLSID\{FA38A758-CFC4-D24D-B315-464B349FD577} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP541\A0045962.exe -> Adware.Lop : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP541\A0045963.exe -> Adware.Lop : Cleaned with backup (quarantined).
    C:\SDFix\backups_old1\backups.zip/backups/tmp9.tmp.exe -> Downloader.Agent.bjk : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054070.exe -> Downloader.Agent.bjk : Cleaned with backup (quarantined).
    C:\WINDOWS\system\svchost.dll -> Downloader.Agent.zi : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\kernels64.exe -> Downloader.FakeAntiSpyware : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\priva.exe -> Downloader.Small.asa : Cleaned with backup (quarantined).
    C:\SDFix\backups_old1\backups.zip/backups/syst555.dll -> Downloader.Small.cyn : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054019.dll -> Downloader.Small.cyn : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054069.dll -> Downloader.Small.cyn : Cleaned with backup (quarantined).
    C:\WINDOWS\sstray.exe -> Dropper.Agent.aax : Cleaned with backup (quarantined).
    C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\Program Files\QuickTime\qttask.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\Program Files\QuickTime\qttask.exe1175572279 -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\Program Files\iTunes\iTunesHelper.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP596\A0049768.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049959.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049960.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049961.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049962.EXE -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049963.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049964.EXE -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049965.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049979.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049982.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\WINDOWS\UpdReg.EXE -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\lsasss.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    [180] C:\Program Files\iTunes\iTunesHelper.exe -> Hijacker.Agent.jh : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\~update.exe -> Proxy.Small.di : Cleaned with backup (quarantined).
    C:\SDFix\backups_old1\backups.zip/backups/wincom32.sys -> Rootkit.Agent.dh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0051999.sys -> Rootkit.Agent.dh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054043.sys -> Rootkit.Agent.dh : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054074.sys -> Rootkit.Agent.dh : Cleaned with backup (quarantined).
    C:\WINDOWS\xxxvts.dll -> Trojan.Agent.agv : Cleaned with backup (quarantined).
    C:\SDFix\backups_old1\backups.zip/backups/latest.exe.exe -> Trojan.Crypt.l : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054026.exe -> Trojan.Crypt.l : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054058.exe -> Trojan.Crypt.l : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\sysvcs.exe -> Trojan.Crypt.l : Cleaned with backup (quarantined).
    C:\SDFix\backups_old1\backups.zip/backups/tmpA.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
    C:\SDFix\backups_old1\backups.zip/backups/tmpC.tmp.exe -> Trojan.Small : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054071.exe -> Trojan.Small : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054072.exe -> Trojan.Small : Cleaned with backup (quarantined).
    C:\SDFix\backups_old1\backups.zip/backups/adirka.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049980.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049988.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0050988.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0050995.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0051995.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0052997.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0053996.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054010.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054031.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054049.dll -> Worm.Banwarum.f : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\msvcrl.dll -> Worm.Locksky.p : Cleaned with backup (quarantined).
    C:\Documents and Settings\Administrator\temp.bak -> Worm.Locksky.t : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\sachostc.exe -> Worm.Locksky.t : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\sachostp.exe -> Worm.Locksky.t : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\sachosts.exe -> Worm.Locksky.t : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\sachostw.exe -> Worm.Locksky.t : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP602\A0054157.dll -> Worm.Zhelatin.al : Cleaned with backup (quarantined).


    ::Report end

    --------------------------------------------------------------------

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, April 04, 2007 8:10:07 AM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.83.0
    Kaspersky Anti-Virus database last update: 4/04/2007
    Kaspersky Anti-Virus database records: 290702
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 41581
    Number of viruses found: 15
    Number of infected objects: 42 / 0
    Number of suspicious objects: 2
    Duration of the scan process: 00:36:48

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007040420070405\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC33.zip/svchost.exe Suspicious: Password-protected-EXE skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC33.zip ZIP: suspicious - 1 skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP542\A0046112.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049978.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049981.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0051998.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0052000.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054027.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054028.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054029.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054032.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054033.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054050.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054051.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054059.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054060.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054075.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054211.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054212.EXE Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054213.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054214.EXE Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054215.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054216.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054217.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054218.EXE Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054219.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054220.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054221.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054222.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054223.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054224.exe Infected: Packed.Win32.Klone.b skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054225.exe Infected: Trojan-Dropper.Win32.Agent.aax skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054226.dll Infected: Trojan-Downloader.Win32.Agent.zi skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054227.exe Infected: Trojan-Downloader.Win32.Tibs.bc skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054228.dll Infected: Email-Worm.Win32.Locksky.p skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054229.exe Infected: Trojan-Downloader.Win32.Small.asa skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054230.exe Infected: Trojan-Proxy.Win32.Small.di skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054231.dll Infected: Trojan.Win32.Agent.agv skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\duo.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\WINDOWS\pep.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{B416D777-928C-4500-8EBD-A850E5C8CB51}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\bak\adirka.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\WINDOWS\system32\bak\adirss.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\duo.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
    C:\WINDOWS\system32\smt.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.

    --------------------------------------------------------------------



    SDFix: Version 1.76

    Run by Administrator - Wed 04/04/2007 - 0:01:01.46

    Microsoft Windows XP [Version 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:





    Restoring Windows Registry Entries
    Restoring Default Hosts File


    Rebooting...

    Normal Mode:
    Checking Files:

    Below files will be copied to Backups folder then removed:

    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\abc123.pid - Deleted



    ADS Check:

    C:\WINDOWS\system32
    No streams found.


    Final Check:

    Remaining Services:
    ------------------



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
    "C:\\Program Files\\Steam\\SteamApps\\skahung123@yahoo.com\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\skahung123@yahoo.com\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
    "C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\dmx18.tmp"="C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\dmx18.tmp:*:Enabled:enable"
    "C:\\WINDOWS\\sachostx.exe"="C:\\WINDOWS\\sachostx.exe:*:Enabled:enable"
    "C:\\WINDOWS\\system32\\sachostw.exe"="C:\\WINDOWS\\system32\\sachostw.exe:*:Enabled:enable"
    "C:\\WINDOWS\\system32\\sachosts.exe"="C:\\WINDOWS\\system32\\sachosts.exe:*:Enabled:enable"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
    "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
    "C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
    "C:\\WINDOWS\\system32\\smt.exe"="C:\\WINDOWS\\system32\\smt.exe:*:Enabled:enable"
    "C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Enabled:enable"


    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"


    Remaining Files:
    ---------------

    Backups Folder: - C:\SDFix\backups\backups.zip

    Checking For Files with Hidden Attributes :

    C:\Program Files\Steam\SteamApps\skahung123@yahoo.com\counter-strike\cstrike\radial.cdb
    C:\WINDOWS\system\svchost.dll
    C:\WINDOWS\system32\tmp_35b.exe
    C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

    Finished
    --------------------------------------------------------------------

    Logfile of HijackThis v1.99.1
    Scan saved at 8:13:02 AM, on 4/4/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O2 - BHO: Shell Event Object Class - {00534B55-3155-CA4F-B41D-0E922121D03C} - C:\WINDOWS\system32\cscentfy.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {bb16f469-49fd-4e43-a889-72b4b5e2d9f4} - C:\WINDOWS\system32\appeng.dll
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\xxxvts.dll",setvm
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://download.pplive.com/webinstall/install.CAB
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://skahung.spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: appeng - C:\WINDOWS\SYSTEM32\appeng.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


     
    ska123, Apr 4, 2007
    #11
  12. KotaGuy

    KotaGuy Regular member

    Joined:
    Feb 14, 2007
    Messages:
    485
    Likes Received:
    0
    Trophy Points:
    26
    Copy/paste the following quotebox into a new Notepad document...

    Save it to your Desktop as fixme.reg. Save it as File Type All Files(not as a text document or it won't work.

    Double click fixme.reg and answer yes when asked to merge it into the registry.

    Please download the Killbox.
    Unzip it to the desktop.

    Please run Killbox.

    Select "Delete on Reboot" and "All files"

    Copy the file names below to the clipboard by highlighting them and pressing Ctrl+C:

    Go to the File menu, and choose Paste from Clipboard.

    Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.

    If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.

    If your computer does not restart automatically, please restart it manually.

    Once back in Windows do another Kaspersky scan and post its new log along with a new HijackThis log please.
     
    Last edited: Apr 4, 2007
    KotaGuy, Apr 4, 2007
    #12
  13. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, April 04, 2007 8:49:57 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.83.0
    Kaspersky Anti-Virus database last update: 5/04/2007
    Kaspersky Anti-Virus database records: 291643
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 43300
    Number of viruses found: 16
    Number of infected objects: 51 / 0
    Number of suspicious objects: 2
    Duration of the scan process: 00:35:12

    Infected Object Name / Virus Name / Last Action
    C:\!KillBox\adirka.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\!KillBox\adirss.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\!KillBox\duo.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\!KillBox\duo.exe( 1) Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\!KillBox\pep.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\!KillBox\smt.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped
    C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Desktop\april 4.doc Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007040420070405\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DFBB33.tmp Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DFC01E.tmp Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WN4JI7OB\CAU7IVA9.html Infected: Trojan-Downloader.Win32.Agent.bjk skipped
    C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC33.zip/svchost.exe Suspicious: Password-protected-EXE skipped
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC33.zip ZIP: suspicious - 1 skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP542\A0046112.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049978.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0049981.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0051998.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0052000.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054027.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054028.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054029.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054032.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054033.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054050.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054051.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054059.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054060.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP601\A0054075.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054211.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054212.EXE Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054213.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054214.EXE Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054215.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054216.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054217.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054218.EXE Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054219.exe Infected: Trojan-Clicker.Win32.Agent.jh skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054220.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054221.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054222.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054223.exe Infected: Email-Worm.Win32.Locksky.t skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054224.exe Infected: Packed.Win32.Klone.b skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054225.exe Infected: Trojan-Dropper.Win32.Agent.aax skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054226.dll Infected: Trojan-Downloader.Win32.Agent.zi skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054227.exe Infected: Trojan-Downloader.Win32.Tibs.bc skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054228.dll Infected: Email-Worm.Win32.Locksky.p skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054229.exe Infected: Trojan-Downloader.Win32.Small.asa skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054230.exe Infected: Trojan-Proxy.Win32.Small.di skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054231.dll Infected: Trojan.Win32.Agent.agv skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054253.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054254.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054255.exe Infected: Email-Worm.Win32.Zhelatin.ck skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054256.exe Infected: Email-Worm.Win32.Zhelatin.cj skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054257.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\A0054258.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped
    C:\System Volume Information\_restore{8D7B33E8-B5AA-42C5-9C14-7B00DA1EA453}\RP603\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\fcyxvs.dll Infected: Trojan.Win32.Agent.agv skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{A3D02057-B7C1-4B64-B14A-AA919FD286A5}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.

    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

    Logfile of HijackThis v1.99.1
    Scan saved at 8:50:35 PM, on 4/4/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O2 - BHO: Shell Event Object Class - {00534B55-3155-CA4F-B41D-0E922121D03C} - C:\WINDOWS\system32\cscentfy.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - C:\WINDOWS\system32\tmp3.tmp.dll
    O2 - BHO: (no name) - {bb16f469-49fd-4e43-a889-72b4b5e2d9f4} - C:\WINDOWS\system32\appeng.dll
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\fcyxvs.dll",setvm
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://download.pplive.com/webinstall/install.CAB
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://skahung.spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: appeng - C:\WINDOWS\SYSTEM32\appeng.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    ska123, Apr 4, 2007
    #13
  14. KotaGuy

    KotaGuy Regular member

    Joined:
    Feb 14, 2007
    Messages:
    485
    Likes Received:
    0
    Trophy Points:
    26
    1. Download this file - combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall
     
    Last edited: Apr 4, 2007
    KotaGuy, Apr 4, 2007
    #14
  15. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    "Administrator" - 07-04-04 22:28:41 Service Pack 2
    ComboFix 07-04-04.5 - Running from: "C:\Documents and Settings\Administrator\Desktop"


    (((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\system32\pfxzmtaim.dll
    C:\WINDOWS\system32\pfxzmtforum.dll
    C:\WINDOWS\system32\pfxzmtgtal.dll
    C:\WINDOWS\system32\pfxzmticq.dll
    C:\WINDOWS\system32\pfxzmtwbmail.dll
    C:\WINDOWS\system32\pfxzmtymsg.dll
    C:\WINDOWS\p.exe
    C:\WINDOWS\system32\tmp3.tmp.dll


    ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\LEGACY_MCHINJDRV


    ((((((((((((((((((((((((((((((( Files Created from 2007-03-04 to 2007-04-04 ))))))))))))))))))))))))))))))))))


    2007-04-04 18:39 <DIR> d-------- C:\!KillBox
    2007-04-04 18:36 106,539 --a------ C:\WINDOWS\fcyxvs.dll
    2007-04-04 00:37 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2007-04-04 00:34 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2007-04-03 23:42 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-04-03 18:37 42 --a------ C:\WINDOWS\a.bat
    2007-04-03 18:20 <DIR> d-------- C:\VundoFix Backups
    2007-04-02 23:17 5 --a------ C:\WINDOWS\system32\fontqxet.dll
    2007-04-02 23:08 9,762 --a------ C:\WINDOWS\system32\msratnit.dll
    2007-04-02 23:08 13 --a------ C:\WINDOWS\system32\rasqervy.dll
    2007-04-02 23:08 0 --a------ C:\WINDOWS\system32\winupdat.dll
    2007-04-02 23:08 0 --a------ C:\WINDOWS\system32\winivfop.dll
    2007-04-02 23:05 8 --a------ C:\WINDOWS\system32\sdfinacs.dll
    2007-04-02 23:05 59,904 --a------ C:\WINDOWS\system32\grlib.dll
    2007-04-02 23:05 0 --a------ C:\WINDOWS\system32\kiscbxz.dat
    2007-04-02 23:04 8,704 --a------ C:\WINDOWS\system32\sporder.dll
    2007-04-02 23:04 23,040 --a------ C:\WINDOWS\system32\cscentfy.dll
    2007-04-02 23:04 115 --a------ C:\WINDOWS\system32\wuasirvy.dll
    2007-04-02 20:25 19,275 --a------ C:\WINDOWS\system32\appeng.dll
    2007-03-28 22:16 <DIR> d-------- C:\WINDOWS\system32\bak
    2007-03-28 22:16 <DIR> d-------- C:\WINDOWS\bak
    2007-03-25 18:23 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-00000008-00001102-00000004-10021102}.dat
    2007-03-25 18:23 288 --a------ C:\WINDOWS\system32\DVCState-{00000002-00000000-00000008-00001102-00000004-10021102}.dat
    2007-03-25 16:44 <DIR> d-------- C:\Program Files\CyberLink
    2007-03-25 16:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
    2007-03-25 16:34 84,992 --------- C:\WINDOWS\system32\SFCVRT32.DLL
    2007-03-25 16:34 82,432 --------- C:\WINDOWS\system32\CTWFLT32.DLL
    2007-03-25 16:34 54,784 --------- C:\WINDOWS\system32\INETWH32.DLL
    2007-03-25 16:34 53,552 --------- C:\WINDOWS\CTCCW.DLL
    2007-03-25 16:34 26,768 --------- C:\WINDOWS\system32\CTL3D.DLL
    2007-03-25 16:34 24,976 --------- C:\WINDOWS\CTRES.DLL
    2007-03-25 16:34 1,048,576 --------- C:\WINDOWS\system32\SFMAN.DAT
    2007-03-25 16:34 <DIR> d-------- C:\WINDOWS\system32\Defaults
    2007-03-25 16:33 94,208 --a------ C:\WINDOWS\DEVREG.DLL
    2007-03-25 16:33 822,416 --a------ C:\WINDOWS\system32\drivers\ha10kx2k.sys
    2007-03-25 16:33 77,824 --a------ C:\WINDOWS\system32\EAXAC3.DLL
    2007-03-25 16:33 655,360 --a------ C:\WINDOWS\system32\ctsblfx.dll
    2007-03-25 16:33 65,536 --a------ C:\WINDOWS\system32\a3d.dll
    2007-03-25 16:33 61,440 --a------ C:\WINDOWS\system32\CTAGENT.DLL
    2007-03-25 16:33 6,144 --a------ C:\WINDOWS\system32\drivers\CTPRXY2K.SYS
    2007-03-25 16:33 53,674 --a------ C:\WINDOWS\system32\ctdaught.dat
    2007-03-25 16:33 53,248 --a------ C:\WINDOWS\system32\AC3API.DLL
    2007-03-25 16:33 497,376 --a------ C:\WINDOWS\system32\drivers\ctaud2k.sys
    2007-03-25 16:33 495,616 --a------ C:\WINDOWS\system32\ctaudfx.dll
    2007-03-25 16:33 49,152 --a------ C:\WINDOWS\system32\KILLAPPS.EXE
    2007-03-25 16:33 49,152 --a------ C:\WINDOWS\MIDIDEF.EXE
    2007-03-25 16:33 49,152 --a------ C:\WINDOWS\CTDCRES.DLL
    2007-03-25 16:33 45,056 --a------ C:\WINDOWS\system32\CTSPKHLP.DLL
    2007-03-25 16:33 393,216 --a------ C:\WINDOWS\system32\CTDC0001.DLL
    2007-03-25 16:33 36,864 --a------ C:\WINDOWS\system32\sfman32.dll
    2007-03-25 16:33 36,864 --a------ C:\WINDOWS\system32\REGPLIB.EXE
    2007-03-25 16:33 36,864 --a------ C:\WINDOWS\system32\CTEMUPIA.DLL
    2007-03-25 16:33 319,488 --a------ C:\WINDOWS\system32\CTDC0000.DLL
    2007-03-25 16:33 28,672 --a------ C:\WINDOWS\system32\CTHELPER.EXE
    2007-03-25 16:33 270,336 --a------ C:\WINDOWS\system32\SFMS32.DLL
    2007-03-25 16:33 248,091 --a------ C:\WINDOWS\system32\ctsbas2w.dat
    2007-03-25 16:33 232,723 --a------ C:\WINDOWS\system32\ctstatic.dat
    2007-03-25 16:33 224,644 --a------ C:\WINDOWS\system32\CTSBASW.DAT
    2007-03-25 16:33 20,480 --a------ C:\WINDOWS\system32\ENSDEF.EXE
    2007-03-25 16:33 20,480 --a------ C:\WINDOWS\INRES.DLL
    2007-03-25 16:33 190,720 --a------ C:\WINDOWS\system32\ctdlang.dat
    2007-03-25 16:33 184,656 --a------ C:\WINDOWS\system32\drivers\ctoss2k.sys
    2007-03-25 16:33 184,320 --a------ C:\WINDOWS\PSCONV.EXE
    2007-03-25 16:33 183,600 --a------ C:\WINDOWS\system32\drivers\CTOSS9X.SYS
    2007-03-25 16:33 176,128 --a------ C:\WINDOWS\READREG.EXE
    2007-03-25 16:33 159,744 --a------ C:\WINDOWS\system32\OPENAL32.DLL
    2007-03-25 16:33 155,648 --a------ C:\WINDOWS\system32\CTOSUSER.DLL
    2007-03-25 16:33 139,968 --a------ C:\WINDOWS\system32\drivers\HAP16V2K.SYS
    2007-03-25 16:33 139,264 --a------ C:\WINDOWS\system32\CTDCIFCE.DLL
    2007-03-25 16:33 138,816 --a------ C:\WINDOWS\system32\ctbas2w.dat
    2007-03-25 16:33 135,248 --a------ C:\WINDOWS\system32\drivers\CTSFM2K.SYS
    2007-03-25 16:33 135,040 --a------ C:\WINDOWS\system32\drivers\CTAC32K.SYS
    2007-03-25 16:33 126,976 --a------ C:\WINDOWS\system32\commonfx.dll
    2007-03-25 16:33 12,160 --a------ C:\WINDOWS\system32\drivers\ctgame.sys
    2007-03-25 16:33 116,000 --a------ C:\WINDOWS\system32\drivers\emupia2k.sys
    2007-03-25 16:33 110,820 --a------ C:\WINDOWS\system32\CTBASICW.DAT
    2007-03-25 16:33 110,592 --a------ C:\WINDOWS\system32\PIAPROXY.DLL
    2007-03-25 16:33 110,592 --a------ C:\WINDOWS\system32\CTSCAL.DLL
    2007-03-25 16:33 110,592 --a------ C:\WINDOWS\system32\CTDPROXY.DLL
    2007-03-25 16:33 110,592 --a------ C:\WINDOWS\system32\CTASIO.DLL
    2007-03-25 16:32 831,600 --a------ C:\WINDOWS\system32\Ctaa1.dat
    2007-03-25 16:32 77,824 --a------ C:\WINDOWS\system32\ctdvda32.dll
    2007-03-25 16:32 286,512 --a------ C:\WINDOWS\system32\drivers\ctdvda2k.sys
    2007-03-25 16:32 184 --a------ C:\WINDOWS\system32\e000003.dat
    2007-03-25 16:32 12,288 --a------ C:\WINDOWS\system32\AHQCpURes.dll
    2007-03-25 16:30 62,976 --a------ C:\WINDOWS\system32\CTDetres.dll
    2007-03-25 16:30 44,032 --a------ C:\WINDOWS\system32\CTSVCCDA.EXE
    2007-03-25 16:30 331,776 --------- C:\WINDOWS\system32\CTMEDENG.DLL
    2007-03-25 16:30 25,088 --a------ C:\WINDOWS\system32\CTSVCCTL.EXE
    2007-03-25 16:30 24,576 --a------ C:\WINDOWS\system32\CTMERes.DLL
    2007-03-24 12:39 36,624 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
    2007-03-09 21:02 <DIR> d-------- C:\Program Files\ItsDeductible2006
    2007-03-09 21:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Intuit
    2007-03-09 21:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intuit
    2007-03-09 21:00 1,716,297 --------- C:\WINDOWS\system32\InetClnt.dll
    2007-03-09 21:00 <DIR> d-------- C:\Program Files\Common Files\Intuit
    2007-03-09 20:59 <DIR> d-------- C:\Program Files\TurboTax
    2007-03-09 20:59 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\InstallShield
    2007-03-08 19:24 <DIR> d-------- C:\Program Files\iTunes
    2007-03-08 19:24 <DIR> d-------- C:\Program Files\iPod
    2007-03-08 19:22 <DIR> d-------- C:\Program Files\QuickTime
    2007-03-08 19:21 <DIR> d-------- C:\Program Files\Apple Software Update


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


    2007-03-27 20:37 -------- d-------- C:\Program Files\steam
    2007-03-25 16:44 -------- d--h----- C:\Program Files\installshield installation information
    2007-03-25 16:34 -------- d-------- C:\Program Files\creative
    2007-03-18 01:31 -------- d-------- C:\Program Files\mp3 wav converter
    2007-02-23 00:29 2560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
    2007-02-23 00:29 2432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2007-02-11 22:31 -------- d-------- C:\Program Files\limewire
    2007-02-10 14:24 20328 --a------ C:\DOCUME~1\ADMINI~1\APPLIC~1\gdipfontcachev1.dat


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

    *Note* empty entries & legit default entries are not shown

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "Steam"=""

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe"
    "CTDVDDet"="C:\\Program Files\\Creative\\SBAudigy2\\DVDAudio\\CTDVDDet.EXE"
    "SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
    "Installed"="1"
    "NoChange"="1"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
    "Installed"="1"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "Steam"=""

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "AsioReg"="REGSVR32.EXE /S CTASIO.DLL"
    "CTDVDDet"="C:\\Program Files\\Creative\\SBAudigy2\\DVDAudio\\CTDVDDet.EXE"
    "CTHelper"="CTHELPER.EXE"
    "CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /run"
    "CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe"
    "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r"
    "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_01\\bin\\jusched.exe"
    "UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
    "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
    "Lexmark_X79-55"="C:\\WINDOWS\\system32\\lsasss.exe"


    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
    "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "NoColorChoice"=dword:00000000
    "NoSizeChoice"=dword:00000000
    "NoDispScrSavPage"=dword:00000000
    "NoDispCPL"=dword:00000000
    "NoVisualStyleChoice"=dword:00000000
    "NoDispSettingsPage"=dword:00000000
    "NoDispAppearancePage"=dword:00000000
    "NoDispBackgroundPage"=dword:00000000

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoActiveDesktopChanges"=dword:00000000
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoSaveSettings"=dword:00000000
    "NoThemesTab"=dword:00000000

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]

    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\appeng

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
    Authentication Packages REG_MULTI_SZ msv1_0\0\0
    Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
    Notification Packages REG_MULTI_SZ scecli\0\0

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
    LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService REG_MULTI_SZ DnsCache\0\0
    rpcss REG_MULTI_SZ RpcSs\0\0
    imgsvc REG_MULTI_SZ StiSvc\0\0
    termsvcs REG_MULTI_SZ TermService\0\0
    HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
    DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
    WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


    [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
    Shell\AutoRun\command F:\LaunchU3.exe
    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_NVCAP
    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_NVTUNEP
    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_NVTVSND
    *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_NVXBAR



    ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

    backup-20070404-000631-941
    O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
    backup-20070402-220651-567
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    backup-20070402-220651-358
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    backup-20070402-220651-703
    O9 - Extra 'Tools' menuitem: PartyCasino.com - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunCasino.exe (file missing)
    backup-20070402-220650-276
    O9 - Extra button: PartyCasino.com - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunCasino.exe (file missing)
    backup-20060114-115310-110
    O21 - SSODL: CtDpfVBlSo - {A44DC923-0EE7-6389-38E3-44B69BBCE763} - C:\WINDOWS\system32\zwkuit.dll (file missing)
    backup-20060114-111438-910
    O21 - SSODL: CtDpfVBlSo - {A44DC923-0EE7-6389-38E3-44B69BBCE763} - C:\WINDOWS\system32\zwkuit.dll
    backup-20060114-111438-273
    O3 - Toolbar: CM Band - {159C2E51-9823-11D2-8DDC-D84A1B4ACD4D} - (no file)
    backup-20060114-111438-181
    R3 - Default URLSearchHook is missing
    backup-20060114-111438-878
    O2 - BHO: CM BHO - {6379A99A-9102-446C-A837-0623E1810D75} - C:\Program Files\Crystalys media\cm.dll (file missing)

    Contents of the 'Scheduled Tasks' folder
    C:\WINDOWS\tasks\AppleSoftwareUpdate.job


    ********************************************************************

    catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
    http://www.gmer.net

    scanning hidden processes ...

    scanning hidden services ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0

    ********************************************************************

    Completion time: 07-04-04 22:30:23
    C:\ComboFix-quarantined-files.txt ... 07-04-04 22:30


    Thanks
     
    ska123, Apr 4, 2007
    #15
  16. KotaGuy

    KotaGuy Regular member

    Joined:
    Feb 14, 2007
    Messages:
    485
    Likes Received:
    0
    Trophy Points:
    26
    Wow... with each scan I have you do I see more and more malware :p

    OK...

    Please download The Avenger by Swandog46 to your Desktop.

    [*]Click on Avenger.zip to open the file
    [*]Extract avenger.exe to your desktop

    Copy all the text contained in the quote box below to your Clipboard by highlighting it and pressing (Ctrl+C):

    Now, start The Avenger program by clicking on its icon on your desktop.

    [*] Under "Script file to execute" choose "Input Script Manually".
    [*] Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
    [*] Paste the text copied to clipboard into this window by pressing (Ctrl+V).
    [*] Click Done
    [*] Now click on the Green Light to begin execution of the script
    [*] Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

    [*] It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    [*] On reboot, it will briefly open a black command window on your desktop, this is normal.
    [*] After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    [*] The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply.

    Thanks.
     
    Last edited: Apr 4, 2007
    KotaGuy, Apr 4, 2007
    #16
  17. The_Fiend

    The_Fiend Guest

    Kotaguy, a question pertaining to this guy's problem, have you had him stop his windows messenger yet *either by hand or with ShootTheMessenger?*
    Because i know some of this malware is famous for redownloading through WM, and causing popups through it.
     
    Last edited by a moderator: Apr 5, 2007
    The_Fiend, Apr 5, 2007
    #17
  18. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of The Avenger version 1, by Swandog46
    Running from registry key:
    \Registry\Machine\System\CurrentControlSet\Services\yxmihomf

    *******************

    Script file located at: \??\C:\Documents and Settings\lrkqgkgm.txt
    Script file opened successfully.

    Script file read successfully

    Backups directory opened successfully at C:\Avenger

    *******************

    Beginning to process script file:

    File C:\WINDOWS\fcyxvs.dll deleted successfully.
    File C:\WINDOWS\a.bat deleted successfully.
    File C:\WINDOWS\system32\fontqxet.dll deleted successfully.
    File C:\WINDOWS\system32\msratnit.dll deleted successfully.
    File C:\WINDOWS\system32\rasqervy.dll deleted successfully.
    File C:\WINDOWS\system32\winupdat.dll deleted successfully.
    File C:\WINDOWS\system32\winivfop.dll deleted successfully.
    File C:\WINDOWS\system32\sdfinacs.dll deleted successfully.
    File C:\WINDOWS\system32\grlib.dll deleted successfully.
    File C:\WINDOWS\system32\kiscbxz.dat deleted successfully.
    File C:\WINDOWS\system32\cscentfy.dll deleted successfully.
    File C:\WINDOWS\system32\wuasirvy.dll deleted successfully.
    File C:\WINDOWS\system32\appeng.dll deleted successfully.


    File C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1.tmp.exe not found!
    Deletion of file C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1.tmp.exe failed!

    Could not process line:
    C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1.tmp.exe
    Status: 0xc0000034



    File C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WN4JI7OB\CAU7IVA9.html not found!
    Deletion of file C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WN4JI7OB\CAU7IVA9.html failed!

    Could not process line:
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WN4JI7OB\CAU7IVA9.html
    Status: 0xc0000034



    Could not delete registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run|SoundService
    Deletion of registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run|SoundService failed!
    Status: 0xc0000034

    Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-|Lexmark_X79-55 deleted successfully.

    Completed script processing.

    *******************

    Finished! Terminate.
     
    Last edited: Apr 5, 2007
    ska123, Apr 5, 2007
    #18
  19. ska123

    ska123 Member

    Joined:
    Jan 13, 2006
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 7:44:26 PM, on 4/5/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: Shell Event Object Class - {00534B55-3155-CA4F-B41D-0E922121D03C} - C:\WINDOWS\system32\cscentfy.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {bb16f469-49fd-4e43-a889-72b4b5e2d9f4} - C:\WINDOWS\system32\appeng.dll (file missing)
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://download.pplive.com/webinstall/install.CAB
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://skahung.spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: appeng - appeng.dll (file missing)
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    ska123, Apr 5, 2007
    #19
  20. KotaGuy

    KotaGuy Regular member

    Joined:
    Feb 14, 2007
    Messages:
    485
    Likes Received:
    0
    Trophy Points:
    26
    Run and scan with HijackThis and place check beside the follwing:

    O2 - BHO: Shell Event Object Class - {00534B55-3155-CA4F-B41D-0E922121D03C} - C:\WINDOWS\system32\cscentfy.dll (file missing)
    O2 - BHO: (no name) - {bb16f469-49fd-4e43-a889-72b4b5e2d9f4} - C:\WINDOWS\system32\appeng.dll (file missing)
    O20 - Winlogon Notify: appeng - appeng.dll (file missing)

    Close all open browsers/windows and click the Fix button.

    Reboot and post a new HijackThis log please.
     
    Last edited: Apr 5, 2007
    KotaGuy, Apr 5, 2007
    #20
Page 1 of 2

Share This Page