Options

please help me

Unknown
edited April 2009 in Spyware & Virus Removal
please help me.i'm not sure my laptop have virus or not.
please check on my hijack this log

Logfile of random's system information tool 1.06 (written by random/random)
Run by user at 2009-04-11 15:00:31
Microsoft Windows XP Professional Service Pack 2
System drive C: has 15 GB (45%) free of 33 GB
Total RAM: 766 MB (8% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:00:53 PM, on 4/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Vista Drive Icon\DrvIcon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\DOCUME~1\user\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Documents and Settings\user\Desktop\RSIT.exe
C:\Program Files\trend micro\user.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\WINDOWS\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10930 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll [2007-06-28 94308]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-09-26 308832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-11-01 198136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-19 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-09-01 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-03-20 251504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2009-04-02 657904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2009-03-20 522224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-19 163840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-19 552960]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-04-02 352256]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-03-20 251504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-07-20 16132608]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2007-07-20 69632]
"AzMixerSel"=C:\Program Files\Realtek\InstallShield\AzMixerSel.exe [2007-07-20 53248]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-07-20 860160]
"LManager"=C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE [2007-07-20 707344]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-07-20 8429568]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-07-20 81920]
"PLFSet"=C:\WINDOWS\PLFSet.dll [2007-04-25 45056]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2007-10-10 36352]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Easy-PrintToolBox"=C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [2004-01-14 409600]
"DrvIcon"=C:\Program Files\Vista Drive Icon\DrvIcon.exe [2007-07-05 45056]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-12 39792]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-09-26 185872]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-02-05 206088]
"mxomssmenu"=C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe [2007-09-06 169264]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-05-12 68856]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"kava"=C:\WINDOWS\system32\kavo.exe []
"Veoh"=C:\Program Files\Veoh Networks\Veoh\VeohClient.exe [2008-08-29 3660848]
""= []
"msnmsgr"=C:\Program Files\MSN Messenger\msnmsgr.exe [2007-01-20 5674352]
"Messenger (Yahoo!)"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2009-01-08 4363504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
C:\Program Files\FlashGet\FlashGet.exe [2007-07-25 1998896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-20 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-10 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-03 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2006-07-22 20036648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe [2006-11-27 97357]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2009-01-08 4363504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [2008-01-12 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE [2007-05-11 738968]

C:\Documents and Settings\user\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-07-24 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-14 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\SPSSInc\SPSS16\spss.exe"="C:\Program Files\SPSSInc\SPSS16\spss.exe:*:Disabled:SPSS 16.0 for Windows (1033:exe)"
"C:\Program Files\SPSSInc\SPSS16\spss.com"="C:\Program Files\SPSSInc\SPSS16\spss.com:*:Disabled:SPSS 16.0 for Windows (1033:com)"
"C:\Program Files\SPSSInc\SPSS16\SPSSWinWrapIDE.exe"="C:\Program Files\SPSSInc\SPSS16\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor (1033)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{145253a9-e0b5-11dd-892d-001b24512d8b}]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{145253aa-e0b5-11dd-892d-001b24512d8b}]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{145253ab-e0b5-11dd-892d-001b24512d8b}]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41b63bbc-de2a-11dd-8926-001b24512d8b}]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53111487-59a6-11dc-9d09-806d6172696f}]
shell\Auto\command - pagefile.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL pagefile.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64b1f2f0-6bb1-11dd-8828-001b24512d8b}]
shell\AutoRun\command - G:\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8038a1be-b699-11dc-8718-001b24512d8b}]
shell\AutoRun\command - RECYCLER\S-1-5-21-1482476501-16444909V7U682003330-1013\ipse32.exe
shell\open\command - RECYCLER\S-1-5-21-1482476501-16444909V7U682003330-1013\ipse32.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8c963bd6-f560-11dc-879b-001b24512d8b}]
shell\AutoRun\command - G:\c18vk.exe
shell\explore\command - G:\c18vk.exe
shell\open\command - G:\c18vk.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4d07b3b-db84-11dc-8774-001b24512d8b}]
shell\AutoRun\command - G:\DataTraveler101R.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be109eee-93e9-11dd-889d-001b24512d8b}]
shell\AutoRun\command - desktop.exe
shell\Explore\command - desktop.exe
shell\Open\command - desktop.exe


======List of files/folders created in the last 1 months======

2009-04-11 15:00:32 ----D---- C:\Program Files\trend micro
2009-04-11 15:00:31 ----D---- C:\rsit
2009-04-06 20:17:34 ----A---- C:\WINDOWS\system32\prsgrc.dll
2009-04-06 20:17:34 ----A---- C:\WINDOWS\system32\grcauth2.dll
2009-04-06 20:17:34 ----A---- C:\WINDOWS\system32\grcauth1.dll
2009-04-06 19:57:09 ----D---- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
2009-04-06 19:54:06 ----D---- C:\Program Files\Common Files\SPSS
2009-04-06 19:54:06 ----D---- C:\Documents and Settings\All Users\Application Data\SPSS
2009-04-06 19:54:03 ----D---- C:\Program Files\SPSSInc
2009-04-06 19:53:31 ----A---- C:\WINDOWS\system32\sysprs7.dll
2009-04-06 19:53:31 ----A---- C:\WINDOWS\system32\lsprst7.dll
2009-04-02 16:17:19 ----D---- C:\Program Files\DIFX
2009-04-02 16:16:52 ----D---- C:\Program Files\PC Connectivity Solution
2009-04-02 16:16:12 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2009-04-02 16:16:11 ----D---- C:\Program Files\Nokia
2009-04-02 16:14:49 ----D---- C:\Documents and Settings\All Users\Application Data\Installations
2009-03-22 09:06:10 ----D---- C:\Program Files\MONOGRAM AMR SplitterDecoder
2009-03-22 09:05:56 ----D---- C:\Program Files\CD Audio Reader Filter
2009-03-22 09:05:49 ----D---- C:\Program Files\DScaler5
2009-03-22 09:05:22 ----D---- C:\Program Files\OpenSource Flash Video Splitter
2009-03-22 09:05:08 ----D---- C:\Program Files\RealMedia
2009-03-22 08:52:47 ----D---- C:\Program Files\SHOUTcast Source
2009-03-22 08:52:38 ----D---- C:\Program Files\Haali
2009-03-22 08:52:20 ----D---- C:\Program Files\DSP-worx
2009-03-22 08:51:43 ----A---- C:\WINDOWS\system32\pthreadGC2.dll
2009-03-22 08:49:29 ----D---- C:\Program Files\DirectVobSub
2009-03-22 08:47:47 ----D---- C:\Program Files\Zoom Player
2009-03-22 08:47:47 ----D---- C:\Documents and Settings\All Users\Application Data\Zoom Player
2009-03-22 08:33:29 ----D---- C:\Documents and Settings\user\Application Data\GRETECH
2009-03-22 08:32:40 ----D---- C:\Program Files\GRETECH

======List of files/folders modified in the last 1 months======

2009-04-11 15:00:33 ----D---- C:\WINDOWS\Temp
2009-04-11 15:00:33 ----D---- C:\WINDOWS\Prefetch
2009-04-11 15:00:32 ----RD---- C:\Program Files
2009-04-11 13:30:07 ----D---- C:\Program Files\Mozilla Firefox
2009-04-11 13:15:16 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-04-10 22:47:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-04-10 20:40:12 ----D---- C:\WINDOWS\system32\CatRoot2
2009-04-08 21:28:20 ----A---- C:\WINDOWS\NeroDigital.ini
2009-04-07 22:24:58 ----D---- C:\WINDOWS
2009-04-06 20:19:55 ----SHD---- C:\WINDOWS\Installer
2009-04-06 20:17:34 ----D---- C:\WINDOWS\system32
2009-04-06 19:54:06 ----D---- C:\Program Files\Common Files
2009-04-06 00:41:06 ----D---- C:\Documents and Settings\user\Application Data\Adobe
2009-04-04 01:01:04 ----HD---- C:\WINDOWS\inf
2009-04-03 23:04:16 ----D---- C:\WINDOWS\Minidump
2009-04-02 21:27:19 ----D---- C:\Program Files\Google
2009-04-02 16:17:17 ----D---- C:\WINDOWS\system32\drivers
2009-04-02 16:17:16 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-03-20 20:23:40 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2009-03-20 20:23:19 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-03-16 23:46:13 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-02-05 226832]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-04 8832]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2007-02-25 39936]
R2 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2007-01-24 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2007-03-22 37376]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2007-07-20 1163616]
R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-07-20 546976]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2007-07-20 16896]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-08 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-20 4424192]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-07-20 6342464]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-07-20 46720]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-07-20 19968]
R3 nvsmu;nvsmu; C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2007-07-20 12032]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-03 67584]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2007-02-08 1729152]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-07-20 208064]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\WINDOWS\system32\drivers\NSDriver.sys []
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800]
S3 catchme;catchme; \??\C:\DOCUME~1\user\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 hidshim;Service for HID-KMDF Shim layer; C:\WINDOWS\system32\DRIVERS\hidshim.sys [2007-05-08 5632]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-18 9600]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 MXOPSWD;Maxtor OneTouch Security Driver; C:\WINDOWS\system32\DRIVERS\mxopswd.sys [2007-05-03 22152]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2004-08-03 11136]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2004-08-03 10240]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-04 78464]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 winbondhidcir;Winbond HID CIR Receiver; C:\WINDOWS\system32\DRIVERS\winbondhidcir.sys [2007-05-08 21504]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-07-07 561152]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\WINDOWS\system32\agrsmsvc.exe [2007-07-20 9216]
R2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-02-05 206088]
R2 Maxtor Sync Service;Maxtor Service; C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 156976]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-07-20 163908]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-10-02 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-02 137200]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-27 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-27 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-20 97136]
EOF
tq:wink:

Comments

  • KatanaKatana
    edited April 2009
    Please note that all instructions given are customised for this computer only,
    the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.

    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. Please Read All Instructions Carefully
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you
    4. Failure to reply within 5 days will result in the topic being closed.
    5. Please continue to respond until I give you the "All Clear"
      (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those few things, everything should go smoothly laechel.gif

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe





    IMPORTANT
    I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    BitLord
    I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

    Also available here.

    My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs
    Please note: you must NOT use any P2P whilst we are cleaning your machine.





    Please ensure that any USB/Flash/External drives are connected whilst we are cleaning your machine.
    Flash Disinfector by sUBs
    Please download Flash_Disinfector.exe by sUBs and save it to your desktop:

    • Double-click Flash_Disinfector.exe to run it.
    • Follow any prompts that may appear.
    • Wait until the program has finished scanning, then please exit the program.
      The tool may ask you to insert your flash drive, or other removable drives. Please do so and allow the tool to clean it up as well.

    Please restart your computer.




    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    • You must download it to and run it from your Desktop
    • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log. Please save that log to post in your next reply
    • Re-enable all the programs that were disabled during the running of ComboFix..



    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
    This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper
  • shikin5646
    edited April 2009
    Katana wrote:
    Please note that all instructions given are customised for this computer only,
    the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.

    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. Please Read All Instructions Carefully
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you
    4. Failure to reply within 5 days will result in the topic being closed.
    5. Please continue to respond until I give you the "All Clear"
      (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those few things, everything should go smoothly laechel.gif

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe





    IMPORTANT
    I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    BitLord
    I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

    Also available here.

    My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs
    Please note: you must NOT use any P2P whilst we are cleaning your machine.





    Please ensure that any USB/Flash/External drives are connected whilst we are cleaning your machine.
    Flash Disinfector by sUBs
    Please download Flash_Disinfector.exe by sUBs and save it to your desktop:

    • Double-click Flash_Disinfector.exe to run it.
    • Follow any prompts that may appear.
    • Wait until the program has finished scanning, then please exit the program.
      The tool may ask you to insert your flash drive, or other removable drives. Please do so and allow the tool to clean it up as well.

    Please restart your computer.




    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    • You must download it to and run it from your Desktop
    • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log. Please save that log to post in your next reply
    • Re-enable all the programs that were disabled during the running of ComboFix..



    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
    This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper

    hi thanks for reply
    i want to uninstall p2p but i dun know which is the program?
    is it only bitlord??
  • KatanaKatana
    edited April 2009
    It's only BitLord that I can see,
    Please post C:\RSIT\Info.txt along with the Combofix log
  • shikin5646
    edited April 2009
    hi thanks for respond to my msg
    this is combofix log

    ComboFix 09-04-04.01 - user 2009-04-12 8:42:49.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.766.359 [GMT 8:00]
    Running from: c:\documents and settings\user\Desktop\ComboFix.exe
    AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
    FW: Kaspersky Internet Security *disabled*
    * Created a new restore point
    .
    - REDUCED FUNCTIONALITY MODE -
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\autorun.inf
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2009-03-12 to 2009-04-12 )))))))))))))))))))))))))))))))
    .

    2009-04-11 15:00 . 2009-04-11 15:01 <DIR> d
    C:\rsit
    2009-04-11 15:00 . 2009-04-11 15:00 <DIR> d
    c:\program files\trend micro
    2009-04-06 20:24 . 2009-04-06 20:24 <DIR> d
    c:\documents and settings\user\.spss
    2009-04-06 20:17 . 2009-04-06 20:17 1,024 --a
    c:\windows\system32\grcauth2.dll
    2009-04-06 20:17 . 2009-04-06 20:17 1,024 --a
    c:\windows\system32\grcauth1.dll
    2009-04-06 20:17 . 2009-04-06 20:17 114 --a
    c:\windows\system32\prsgrc.tgz
    2009-04-06 20:17 . 2009-04-06 20:17 100 --a
    c:\windows\system32\prsgrc.dll
    2009-04-06 19:57 . 2009-04-06 19:57 <DIR> d
    c:\documents and settings\All Users\Application Data\SafeNet Sentinel
    2009-04-06 19:54 . 2009-04-06 19:54 <DIR> d
    c:\program files\SPSSInc
    2009-04-06 19:54 . 2009-04-06 19:54 <DIR> d
    c:\program files\Common Files\SPSS
    2009-04-06 19:54 . 2009-04-06 19:54 <DIR> d
    c:\documents and settings\All Users\Application Data\SPSS
    2009-04-06 19:53 . 2009-04-06 19:53 1,025 --a
    c:\windows\system32\sysprs7.tgz
    2009-04-06 19:53 . 2009-04-06 19:53 1,025 --a
    c:\windows\system32\sysprs7.dll
    2009-04-06 19:53 . 2009-04-06 19:53 219 --a
    c:\windows\system32\lsprst7.tgz
    2009-04-06 19:53 . 2009-04-06 19:53 205 --a
    c:\windows\system32\lsprst7.dll
    2009-04-06 19:53 . 2009-04-06 19:53 16 ---h
    c:\windows\system32\servdat.slm
    2009-04-06 19:53 . 2009-04-06 19:53 0 --a
    C:\law.sp
    2009-04-02 16:17 . 2009-04-02 16:17 <DIR> d
    c:\program files\DIFX
    2009-04-02 16:17 . 2008-08-26 09:26 18,816 --a
    c:\windows\system32\drivers\pccsmcfd.sys
    2009-04-02 16:16 . 2009-04-02 16:16 <DIR> d
    c:\program files\PC Connectivity Solution
    2009-04-02 16:16 . 2009-04-02 16:17 <DIR> d
    c:\program files\Nokia
    2009-04-02 16:16 . 2008-09-15 07:56 91,136 --a
    c:\windows\system32\nmwcdcls.dll
    2009-04-02 16:14 . 2009-04-02 16:14 <DIR> d
    c:\documents and settings\All Users\Application Data\Installations
    2009-03-22 09:06 . 2009-03-22 09:06 <DIR> d
    c:\program files\MONOGRAM AMR SplitterDecoder
    2009-03-22 09:05 . 2009-03-22 09:05 <DIR> d
    c:\program files\RealMedia
    2009-03-22 09:05 . 2009-03-22 09:05 <DIR> d
    c:\program files\OpenSource Flash Video Splitter
    2009-03-22 09:05 . 2009-03-22 09:05 <DIR> d
    c:\program files\DScaler5
    2009-03-22 09:05 . 2009-03-22 09:05 <DIR> d
    c:\program files\CD Audio Reader Filter
    2009-03-22 08:52 . 2009-03-22 08:52 <DIR> d
    c:\program files\SHOUTcast Source
    2009-03-22 08:52 . 2009-03-22 08:52 <DIR> d
    c:\program files\Haali
    2009-03-22 08:52 . 2009-03-22 08:52 <DIR> d
    c:\program files\DSP-worx
    2009-03-22 08:51 . 2008-12-11 13:26 60,273 --a
    c:\windows\system32\pthreadGC2.dll
    2009-03-22 08:49 . 2009-03-22 08:49 <DIR> d
    c:\program files\DirectVobSub
    2009-03-22 08:47 . 2009-03-22 09:01 <DIR> d
    c:\program files\Zoom Player
    2009-03-22 08:47 . 2009-03-22 08:47 <DIR> d
    c:\documents and settings\All Users\Application Data\Zoom Player
    2009-03-22 08:33 . 2009-03-22 08:33 <DIR> d
    c:\documents and settings\user\Application Data\GRETECH
    2009-03-22 08:32 . 2009-03-22 08:32 <DIR> d
    c:\program files\GRETECH

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-04-12 00:41 393,248 --sha-w c:\windows\system32\drivers\fidbox2.dat
    2009-04-12 00:41 3,472 --sha-w c:\windows\system32\drivers\fidbox2.idx
    2009-04-12 00:17
    d
    w c:\documents and settings\All Users\Application Data\Kaspersky Lab
    2009-04-11 16:13 27,192 --sha-w c:\windows\system32\drivers\fidbox.idx
    2009-04-11 16:13 2,537,504 --sha-w c:\windows\system32\drivers\fidbox.dat
    2009-04-11 14:41
    d
    w c:\program files\BitLord
    2009-04-02 13:27
    d
    w c:\program files\Google
    2009-03-20 12:23
    d
    w c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-03-16 15:46
    d
    w c:\documents and settings\All Users\Application Data\Microsoft Help
    .
    Sigcheck

    2004-08-04 00:56 690176 3a5ee0514f56b1b775d7641cfba5ad37 c:\windows\system32\wininet.dll
    2004-08-04 00:56 690176 3a5ee0514f56b1b775d7641cfba5ad37 c:\windows\system32\dllcache\wininet.dll

    2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\system32\dllcache\tcpip.sys
    2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e c:\windows\system32\drivers\tcpip.sys

    2004-08-04 00:56 974336 a5c1f2cf7c31874e66478910b43d6513 c:\windows\explorer.exe
    2004-08-04 00:56 974336 a5c1f2cf7c31874e66478910b43d6513 c:\windows\system32\dllcache\explorer.exe

    2004-08-04 00:56 100864 80cb133bd6c830e8ca7e90015e45c1cd c:\windows\system32\wuauclt.exe
    2004-08-04 00:56 100864 80cb133bd6c830e8ca7e90015e45c1cd c:\windows\system32\dllcache\wuauclt.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-12 68856]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
    "Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-29 3660848]
    "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-20 5674352]
    "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-01-08 4363504]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2007-07-20 53248]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-20 860160]
    "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-20 707344]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-20 8429568]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-20 81920]
    "PLFSet"="c:\windows\PLFSet.dll" [2007-04-25 45056]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-10-10 36352]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
    "Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
    "DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2007-07-05 45056]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-26 185872]
    "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 206088]
    "mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
    "RTHDCPL"="RTHDCPL.EXE" [2007-07-20 c:\windows\RTHDCPL.exe]
    "nwiz"="nwiz.exe" [2007-07-20 c:\windows\system32\nwiz.exe]

    c:\documents and settings\user\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-17 113664]
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]
    RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
    UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-14 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-07-24 07:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.divxa32"= msaud32_divx.acm

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
    backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
    --a
    2007-07-25 18:22 1998896 c:\program files\FlashGet\flashget.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    --a
    2007-01-20 03:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a
    2001-07-10 02:50 155648 c:\windows\system32\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    --a
    2004-11-03 11:24 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    --a
    2006-07-22 04:06 20036648 c:\program files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
    --a
    2006-11-27 02:30 97357 c:\program files\Ringz Studio\Storm Codec\StormSet.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    --a
    2009-01-08 19:38 4363504 c:\program files\Yahoo!\Messenger\YahooMessenger.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\FlashGet\\flashget.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\MSN Messenger\\livecall.exe"=
    "c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\SPSSInc\\SPSS16\\spss.exe"=
    "c:\\Program Files\\SPSSInc\\SPSS16\\spss.com"=
    "c:\\Program Files\\SPSSInc\\SPSS16\\SPSSWinWrapIDE.exe"=

    R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-09-04 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-09-04 55024]
    R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
    S3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\drivers\hidshim.sys [2007-08-16 5632]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-04 7408]
    S3 winbondhidcir;Winbond HID CIR Receiver;c:\windows\system32\drivers\winbondhidcir.sys [2007-08-16 21504]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
    \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
    \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41b63bbc-de2a-11dd-8926-001b24512d8b}]
    \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53111487-59a6-11dc-9d09-806d6172696f}]
    \Shell\Auto\command - pagefile.exe
    \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL pagefile.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64b1f2f0-6bb1-11dd-8828-001b24512d8b}]
    \Shell\AutoRun\command - G:\WDSetup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8038a1be-b699-11dc-8718-001b24512d8b}]
    \Shell\AutoRun\command - RECYCLER\S-1-5-21-1482476501-16444909V7U682003330-1013\ipse32.exe
    \Shell\open\command - RECYCLER\S-1-5-21-1482476501-16444909V7U682003330-1013\ipse32.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8c963bd6-f560-11dc-879b-001b24512d8b}]
    \Shell\AutoRun\command - G:\c18vk.exe
    \Shell\explore\Command - G:\c18vk.exe
    \Shell\open\Command - G:\c18vk.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4d07b3b-db84-11dc-8774-001b24512d8b}]
    \Shell\AutoRun\command - G:\DataTraveler101R.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be109eee-93e9-11dd-889d-001b24512d8b}]
    \Shell\AutoRun\command - desktop.exe
    \Shell\Explore\command - desktop.exe
    \Shell\Open\command - desktop.exe
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
    MSConfigStartUp-AVG7_CC - c:\progra~1\Grisoft\AVG7\avgcc.exe


    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.yahoo.com/
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    mStart Page = hxxp://www.yahoo.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm
    IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm
    IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\xk8k3oew.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
    FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
    FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
    .

    **************************************************************************

    catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-04-12 08:43:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    msnmsgr = "c:\program files\MSN Messenger\msnmsgr.exe" /background?g

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'winlogon.exe'(1188)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    .
    Completion time: 2009-04-12 8:48:37
    ComboFix-quarantined-files.txt 2009-04-12 00:48:31

    Pre-Run: 15,231,279,104 bytes free
    Post-Run: 15,997,042,688 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    247
  • shikin5646
    edited April 2009
    hi.
    now, my laptop are free from virus???:confused:
  • KatanaKatana
    edited April 2009
    now, my laptop are free from virus??
    Soon :)


    Download ComboFix
    Please delete the copy of ComboFix that you have and download an updated copy from one of the links below
      ComboFix.exe 1
      ComboFix.exe 2
      ComboFix.exe 3


      [*] You must download it to your Desktop




      Custom CFScript
      • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
        http://icrontic.com/forum/showthread.php?p=681154#post681154
Comment:: Katana -- Suspect files
Suspect::[4]
c:\windows\system32\wininet.dll
c:\windows\system32\dllcache\tcpip.sys
c:\windows\explorer.exe
c:\windows\system32\wuauclt.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{53111487-59a6-11dc-9d09-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{64b1f2f0-6bb1-11dd-8828-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{8038a1be-b699-11dc-8718-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{8c963bd6-f560-11dc-879b-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{b4d07b3b-db84-11dc-8774-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{be109eee-93e9-11dd-889d-001b24512d8b}]
ADS::
      • Save this as CFScript.txt and place it on your desktop.


        CFScriptb.gif


      • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
      • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
      • **Note**
        When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
        • Ensure you are connected to the internet and click OK on the message box.

      • Copy and paste the contents of the log in your next reply.


      CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
      Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.





      Active Scan
      Please ensure that any USB/Flash/External drives are connected whilst we are cleaning your machine.
      Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
      NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
      Please go to this site Link >> ActiveScan << LINK
      • Click the Scan Now button
      • Follow the prompts to install the Active X if necessary
      • Go and make a cup of tea/coffee/beverage of your choice and watch some TV :)
      • When the scan is finished, a report will be generated
      • Next to Scan Details click the small export to notepad button and save the report to your desktop.
      • Please post the report in your reply.





      Logs/Information to Post in Reply
      Please post the following logs/Information in your reply
      • Combofix log
      • Active scan log
      • C:\RSIT\Info.txt
      • How are things running now ?
    • shikin5646
      edited April 2009
      combofix log

      ComboFix 09-04-13.A2 - user 2009-04-14 9:13.2 - NTFSx86
      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.766.212 [GMT 8:00]
      Running from: c:\documents and settings\user\Desktop\ComboFix.exe
      Command switches used :: c:\documents and settings\user\Desktop\CFScript .txt
      AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
      FW: Kaspersky Internet Security *disabled*
      * Created a new restore point
      .

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      c:\windows\system32\lsprst7.dll
      c:\windows\system32\prsgrc.dll
      c:\windows\system32\pthreadGC2.dll

      .
      ((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
      .

      2009-04-11 07:00 . 2009-04-11 07:01
      d
      w C:\rsit
      2009-04-06 12:24 . 2009-04-06 12:24
      d
      w c:\documents and settings\user\.spss
      2009-04-06 12:17 . 2009-04-06 12:17 114 ----a-w c:\windows\system32\prsgrc.tgz
      2009-04-06 12:17 . 2009-04-06 12:17 1024 ----a-w c:\windows\system32\grcauth2.dll
      2009-04-06 12:17 . 2009-04-06 12:17 1024 ----a-w c:\windows\system32\grcauth1.dll
      2009-04-06 11:57 . 2009-04-06 11:57
      d
      w c:\documents and settings\All Users\Application Data\SafeNet Sentinel
      2009-04-06 11:54 . 2009-04-06 11:54
      d
      w c:\documents and settings\All Users\Application Data\SPSS
      2009-04-06 11:53 . 2009-04-06 11:53 16 ---h--w c:\windows\system32\servdat.slm
      2009-04-06 11:53 . 2009-04-06 11:53 219 ----a-w c:\windows\system32\lsprst7.tgz
      2009-04-06 11:53 . 2009-04-06 11:53 1025 ----a-w c:\windows\system32\sysprs7.tgz
      2009-04-06 11:53 . 2009-04-06 11:53 1025 ----a-w c:\windows\system32\sysprs7.dll
      2009-04-06 11:53 . 2009-04-06 11:53 0 ----a-w C:\law.sp
      2009-04-04 14:59 . 2009-04-08 13:32
      d
      w c:\documents and settings\user\Local Settings\Application Data\WMTools Downloaded Files
      2009-04-02 08:17 . 2008-08-26 01:26 18816 ----a-w c:\windows\system32\drivers\pccsmcfd.sys
      2009-04-02 08:16 . 2008-09-14 23:56 91136 ----a-w c:\windows\system32\nmwcdcls.dll
      2009-04-02 08:14 . 2009-04-02 08:14
      d
      w c:\documents and settings\All Users\Application Data\Installations
      2009-03-22 00:47 . 2009-03-22 00:47
      d
      w c:\documents and settings\All Users\Application Data\Zoom Player
      2009-03-22 00:33 . 2009-03-22 00:33
      d
      w c:\documents and settings\user\Application Data\GRETECH

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2009-04-14 01:24 . 2009-01-09 07:35 27220 --sha-w c:\windows\system32\drivers\fidbox.idx
      2009-04-14 01:23 . 2007-12-03 14:13
      d
      w c:\documents and settings\All Users\Application Data\Kaspersky Lab
      2009-04-14 01:21 . 2009-01-09 07:35 401440 --sha-w c:\windows\system32\drivers\fidbox2.dat
      2009-04-14 01:21 . 2009-01-09 07:35 401440 --sha-w c:\windows\system32\drivers\fidbox2.dat
      2009-04-14 01:21 . 2009-01-09 07:35 3500 --sha-w c:\windows\system32\drivers\fidbox2.idx
      2009-04-14 01:21 . 2009-01-09 07:35 2537504 --sha-w c:\windows\system32\drivers\fidbox.dat
      2009-04-14 01:21 . 2009-01-09 07:35 2537504 --sha-w c:\windows\system32\drivers\fidbox.dat
      2009-04-13 06:23 . 2008-09-01 19:07 268 ---ha-w C:\sqmdata17.sqm
      2009-04-13 06:23 . 2008-09-01 19:07 244 ---ha-w C:\sqmnoopt17.sqm
      2009-04-12 10:19 . 2008-09-01 04:23 268 ---ha-w C:\sqmdata16.sqm
      2009-04-12 10:19 . 2008-09-01 04:23 244 ---ha-w C:\sqmnoopt16.sqm
      2009-04-11 16:12 . 2008-08-31 21:10 268 ---ha-w C:\sqmdata15.sqm
      2009-04-11 16:12 . 2008-08-31 21:10 244 ---ha-w C:\sqmnoopt15.sqm
      2009-04-11 15:45 . 2008-08-31 17:54 268 ---ha-w C:\sqmdata14.sqm
      2009-04-11 15:45 . 2008-08-31 17:54 244 ---ha-w C:\sqmnoopt14.sqm
      2009-04-11 14:41 . 2008-05-24 04:11
      d
      w c:\program files\BitLord
      2009-04-11 07:25 . 2008-08-31 05:03 268 ---ha-w C:\sqmdata13.sqm
      2009-04-11 07:25 . 2008-08-31 05:03 244 ---ha-w C:\sqmnoopt13.sqm
      2009-04-11 07:00 . 2009-04-11 07:00
      d
      w c:\program files\trend micro
      2009-04-10 14:47 . 2008-08-31 00:17 268 ---ha-w C:\sqmdata12.sqm
      2009-04-10 14:47 . 2008-08-31 00:17 244 ---ha-w C:\sqmnoopt12.sqm
      2009-04-10 05:02 . 2008-08-29 07:04 268 ---ha-w C:\sqmdata11.sqm
      2009-04-10 05:02 . 2008-08-29 07:04 244 ---ha-w C:\sqmnoopt11.sqm
      2009-04-10 01:00 . 2008-08-29 04:06 268 ---ha-w C:\sqmdata10.sqm
      2009-04-10 01:00 . 2008-08-29 04:06 244 ---ha-w C:\sqmnoopt10.sqm
      2009-04-09 14:31 . 2008-08-28 20:41 268 ---ha-w C:\sqmdata09.sqm
      2009-04-09 14:31 . 2008-08-28 20:41 244 ---ha-w C:\sqmnoopt09.sqm
      2009-04-08 15:30 . 2008-08-28 06:40 268 ---ha-w C:\sqmdata08.sqm
      2009-04-08 15:30 . 2008-08-28 06:40 244 ---ha-w C:\sqmnoopt08.sqm
      2009-04-07 22:52 . 2008-08-27 22:27 268 ---ha-w C:\sqmdata07.sqm
      2009-04-07 22:52 . 2008-08-27 22:27 244 ---ha-w C:\sqmnoopt07.sqm
      2009-04-07 15:43 . 2008-08-27 00:00 268 ---ha-w C:\sqmdata06.sqm
      2009-04-07 15:43 . 2008-08-27 00:00 244 ---ha-w C:\sqmnoopt06.sqm
      2009-04-07 10:43 . 2008-08-26 07:24 268 ---ha-w C:\sqmdata05.sqm
      2009-04-07 10:43 . 2008-08-26 07:24 244 ---ha-w C:\sqmnoopt05.sqm
      2009-04-06 16:57 . 2008-08-26 06:19 268 ---ha-w C:\sqmdata04.sqm
      2009-04-06 16:57 . 2008-08-26 06:19 244 ---ha-w C:\sqmnoopt04.sqm
      2009-04-06 13:29 . 2007-08-16 02:52 69744 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
      2009-04-06 11:54 . 2009-04-06 11:54
      d
      w c:\program files\Common Files\SPSS
      2009-04-06 11:54 . 2009-04-06 11:54
      d
      w c:\program files\SPSSInc
      2009-04-05 17:13 . 2008-08-26 05:51 268 ---ha-w C:\sqmdata03.sqm
      2009-04-05 17:13 . 2008-08-26 05:51 244 ---ha-w C:\sqmnoopt03.sqm
      2009-04-04 18:58 . 2008-08-25 18:08 268 ---ha-w C:\sqmdata02.sqm
      2009-04-04 18:58 . 2008-08-25 18:08 244 ---ha-w C:\sqmnoopt02.sqm
      2009-04-04 18:51 . 2008-08-21 20:05 268 ---ha-w C:\sqmdata01.sqm
      2009-04-04 18:51 . 2008-08-21 20:05 244 ---ha-w C:\sqmnoopt01.sqm
      2009-04-04 11:47 . 2007-08-16 03:12 268 ---ha-w C:\sqmdata00.sqm
      2009-04-04 11:47 . 2007-08-16 03:12 244 ---ha-w C:\sqmnoopt00.sqm
      2009-04-04 08:25 . 2008-09-04 11:14 268 ---ha-w C:\sqmdata19.sqm
      2009-04-04 08:25 . 2008-09-04 11:14 244 ---ha-w C:\sqmnoopt19.sqm
      2009-04-03 18:22 . 2008-09-02 05:36 268 ---ha-w C:\sqmdata18.sqm
      2009-04-03 18:22 . 2008-09-02 05:36 244 ---ha-w C:\sqmnoopt18.sqm
      2009-04-02 13:27 . 2007-08-16 03:04
      d
      w c:\program files\Google
      2009-04-02 08:17 . 2009-04-02 08:16
      d
      w c:\program files\Nokia
      2009-04-02 08:17 . 2009-04-02 08:17
      d
      w c:\program files\DIFX
      2009-04-02 08:16 . 2009-04-02 08:16
      d
      w c:\program files\PC Connectivity Solution
      2009-03-22 01:06 . 2009-03-22 01:06
      d
      w c:\program files\MONOGRAM AMR SplitterDecoder
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\CD Audio Reader Filter
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\DScaler5
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\OpenSource Flash Video Splitter
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\RealMedia
      2009-03-22 01:01 . 2009-03-22 00:47
      d
      w c:\program files\Zoom Player
      2009-03-22 00:52 . 2009-03-22 00:52
      d
      w c:\program files\SHOUTcast Source
      2009-03-22 00:52 . 2009-03-22 00:52
      d
      w c:\program files\Haali
      2009-03-22 00:52 . 2009-03-22 00:52
      d
      w c:\program files\DSP-worx
      2009-03-22 00:49 . 2009-03-22 00:49
      d
      w c:\program files\DirectVobSub
      2009-03-22 00:32 . 2009-03-22 00:32
      d
      w c:\program files\GRETECH
      2009-03-20 12:23 . 2007-12-11 18:37
      d
      w c:\documents and settings\All Users\Application Data\Yahoo! Companion
      2009-03-16 15:46 . 2008-01-09 04:24
      d
      w c:\documents and settings\All Users\Application Data\Microsoft Help
      .
      Sigcheck

      [-] 2004-08-03 16:56 690176 3A5EE0514F56B1B775D7641CFBA5AD37 c:\windows\system32\wininet.dll
      [-] 2004-08-03 16:56 690176 3A5EE0514F56B1B775D7641CFBA5AD37 c:\windows\system32\dllcache\wininet.dll

      [7] 2004-08-03 15:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\system32\dllcache\tcpip.sys
      [-] 2004-08-03 15:14 359040 6A603809F598332DBEDD535BDBCE313E c:\windows\system32\drivers\tcpip.sys

      [-] 2004-08-03 16:56 974336 A5C1F2CF7C31874E66478910B43D6513 c:\windows\explorer.exe
      [-] 2004-08-03 16:56 974336 A5C1F2CF7C31874E66478910B43D6513 c:\windows\system32\dllcache\explorer.exe

      [-] 2004-08-03 16:56 100864 80CB133BD6C830E8CA7E90015E45C1CD c:\windows\system32\wuauclt.exe
      [-] 2004-08-03 16:56 100864 80CB133BD6C830E8CA7E90015E45C1CD c:\windows\system32\dllcache\wuauclt.exe
      .
      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-12 68856]
      "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
      "Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-29 3660848]
      "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-20 5674352]
      "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-01-08 4363504]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2007-07-20 53248]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-20 860160]
      "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-20 707344]
      "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-20 8429568]
      "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-20 81920]
      "PLFSet"="c:\windows\PLFSet.dll" [2007-04-25 45056]
      "WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-10-10 36352]
      "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
      "Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
      "DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2007-07-05 45056]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
      "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-26 185872]
      "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 206088]
      "mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
      "RTHDCPL"="RTHDCPL.EXE" [2007-07-20 c:\windows\RTHDCPL.exe]
      "nwiz"="nwiz.exe" [2007-07-20 c:\windows\system32\nwiz.exe]

      c:\documents and settings\user\Start Menu\Programs\Startup\
      Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-17 113664]
      OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]
      RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
      UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]

      [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
      "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-14 77824]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
      2008-07-24 07:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "msacm.divxa32"= msaud32_divx.acm

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
      path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
      backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
      path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
      backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
      --a
      2007-07-25 18:22 1998896 c:\program files\FlashGet\flashget.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
      --a
      2007-01-20 03:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
      --a
      2001-07-10 02:50 155648 c:\windows\system32\NeroCheck.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
      --a
      2004-11-03 11:24 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
      --a
      2006-07-22 04:06 20036648 c:\program files\Skype\Phone\Skype.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
      --a
      2006-11-27 02:30 97357 c:\program files\Ringz Studio\Storm Codec\StormSet.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
      --a
      2009-01-08 19:38 4363504 c:\program files\Yahoo!\Messenger\YahooMessenger.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
      "AntiVirusDisableNotify"=dword:00000001
      "UpdatesDisableNotify"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "c:\\Program Files\\FlashGet\\flashget.exe"=
      "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
      "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
      "c:\\Program Files\\MSN Messenger\\livecall.exe"=
      "c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
      "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
      "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
      "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
      "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
      "c:\\Program Files\\SPSSInc\\SPSS16\\spss.exe"=
      "c:\\Program Files\\SPSSInc\\SPSS16\\spss.com"=
      "c:\\Program Files\\SPSSInc\\SPSS16\\SPSSWinWrapIDE.exe"=

      R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2007-05-08 5632]
      R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-04 7408]
      R3 winbondhidcir;Winbond HID CIR Receiver;c:\windows\system32\DRIVERS\winbondhidcir.sys [2007-05-08 21504]
      S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-05 33808]
      S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-09-04 8944]
      S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-09-04 55024]
      S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
      S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]


      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
      \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
      \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41b63bbc-de2a-11dd-8926-001b24512d8b}]
      \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53111487-59a6-11dc-9d09-806d6172696f}]
      \Shell\Auto\command - pagefile.exe
      \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL pagefile.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64b1f2f0-6bb1-11dd-8828-001b24512d8b}]
      \Shell\AutoRun\command - G:\WDSetup.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8c963bd6-f560-11dc-879b-001b24512d8b}]
      \Shell\AutoRun\command - G:\c18vk.exe
      \Shell\explore\Command - G:\c18vk.exe
      \Shell\open\Command - G:\c18vk.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4d07b3b-db84-11dc-8774-001b24512d8b}]
      \Shell\AutoRun\command - G:\DataTraveler101R.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be109eee-93e9-11dd-889d-001b24512d8b}]
      \Shell\AutoRun\command - desktop.exe
      \Shell\Explore\command - desktop.exe
      \Shell\Open\command - desktop.exe
      .
      .
      Supplementary Scan
      .
      uStart Page = hxxp://www.yahoo.com/
      uSearch Page = hxxp://www.google.com
      uSearch Bar = hxxp://www.google.com/ie
      mStart Page = hxxp://www.yahoo.com/
      mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
      uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
      IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm
      IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm
      IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
      IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
      IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
      IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
      IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
      IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
      FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\xk8k3oew.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
      FF - prefs.js: browser.search.selectedEngine - Google
      FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
      FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
      FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
      FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
      .

      **************************************************************************

      catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2009-04-14 09:24
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************
      .
      DLLs Loaded Under Running Processes

      - - - - - - - > 'winlogon.exe'(1192)
      c:\program files\SUPERAntiSpyware\SASWINLO.dll

      - - - - - - - > 'explorer.exe'(988)
      c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
      c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
      c:\windows\system32\ntshrui.dll
      c:\windows\system32\NETSHELL.dll
      c:\windows\system32\credui.dll
      c:\windows\system32\msi.dll
      .
      Other Running Processes
      .
      c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
      c:\windows\system32\agrsmsvc.exe
      c:\program files\Maxtor\Sync\SyncServices.exe
      c:\windows\system32\nvsvc32.exe
      c:\windows\system32\rundll32.exe
      c:\docume~1\user\LOCALS~1\Temp\RtkBtMnt.exe
      c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
      c:\windows\system32\wscntfy.exe
      .
      **************************************************************************
      .
      Completion time: 2009-04-14 9:28 - machine was rebooted
      ComboFix-quarantined-files.txt 2009-04-14 01:28
      ComboFix2.txt 2009-04-12 00:48

      Pre-Run: 15,956,275,200 bytes free
      Post-Run: 15,870,144,512 bytes free

      292
    • shikin5646
      edited April 2009
      active scan

      ;***********************************************************************************************************************************************************************************
      ANALYSIS: 2009-04-14 12:33:07
      PROTECTIONS: 1
      MALWARE: 16
      SUSPECTS: 0
      ;***********************************************************************************************************************************************************************************
      PROTECTIONS
      Description Version Active Updated
      ;===================================================================================================================================================================================
      Kaspersky Internet Security 8.0.0.506 Yes Yes
      ;===================================================================================================================================================================================
      MALWARE
      Id Description Type Active Severity Disinfectable Disinfected Location
      ;===================================================================================================================================================================================
      00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@doubleclick[1].txt
      00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@atdmt[2].txt
      00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@mediaplex[1].txt
      00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@com[1].txt
      00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@statcounter[1].txt
      00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@ad.yieldmanager[2].txt
      00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@apmebf[1].txt
      00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@serving-sys[2].txt
      00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@bs.serving-sys[1].txt
      00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@adtech[1].txt
      00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@ads.pointroll[1].txt
      00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@questionmarket[1].txt
      00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@atwola[1].txt
      00366244 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\user\Desktop\Flash_Disinfector.exe[C:\Documents and Settings\user\Desktop\Flash_Disinfector.exe][nircmd.exe]
      01048523 Generic Malware Virus/Trojan No 0 Yes No C:\Program Files\WinRAR\patch.exe
      02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{6008AF19-CCB0-49D2-A3DA-0CD42C0579AE}\RP98\A0037584.sys
      ;===================================================================================================================================================================================
      SUSPECTS
      Sent Location 0
      ;===================================================================================================================================================================================
      ;===================================================================================================================================================================================
      VULNERABILITIES
      Id Severity Description 0
      ;===================================================================================================================================================================================
      184380 MEDIUM MS08-002 0
      184379 MEDIUM MS08-001 0
      182048 HIGH MS07-069 0
      182046 HIGH MS07-067 0
      182043 HIGH MS07-064 0
      179553 HIGH MS07-061 0
      176382 HIGH MS07-057 0
      176383 HIGH MS07-058 0
      170911 HIGH MS07-050 0
      170907 HIGH MS07-046 0
      170906 HIGH MS07-045 0
      170904 HIGH MS07-043 0
      164915 HIGH MS07-035 0
      164913 HIGH MS07-033 0
      164911 HIGH MS07-031 0
      160623 HIGH MS07-027 0
      157262 HIGH MS07-022 0
      157261 HIGH MS07-021 0
      157260 HIGH MS07-020 0
      157259 HIGH MS07-019 0
      156477 HIGH MS07-017 0
      150253 HIGH MS07-016 0
      150249 HIGH MS07-013 0
      150248 HIGH MS07-012 0
      150247 HIGH MS07-011 0
      150243 HIGH MS07-008 0
      150242 HIGH MS07-007 0
      150241 MEDIUM MS07-006 0
      141034 HIGH MS06-076 0
      141033 MEDIUM MS06-075 0
      141030 HIGH MS06-072 0
      137571 HIGH MS06-070 0
      137568 HIGH MS06-067 0
      133387 MEDIUM MS06-065 0
      133386 MEDIUM MS06-064 0
      133385 MEDIUM MS06-063 0
      133379 HIGH MS06-057 0
      131654 HIGH MS06-055 0
      129977 MEDIUM MS06-053 0
      129976 MEDIUM MS06-052 0
      126093 HIGH MS06-051 0
      126092 MEDIUM MS06-050 0
      126087 HIGH MS06-046 0
      126086 MEDIUM MS06-045 0
      126083 HIGH MS06-042 0
      126082 HIGH MS06-041 0
      126081 HIGH MS06-040 0
      123421 HIGH MS06-036 0
      123420 HIGH MS06-035 0
      120825 MEDIUM MS06-032 0
      120823 MEDIUM MS06-030 0
      120818 HIGH MS06-025 0
      120815 HIGH MS06-022 0
      120814 HIGH MS06-021 0
      117384 MEDIUM MS06-018 0
      114666 HIGH MS06-015 0
      114664 HIGH MS06-013 0
      108744 MEDIUM MS06-008 0
      108743 MEDIUM MS06-007 0
      108742 MEDIUM MS06-006 0
      104567 HIGH MS06-002 0
      104237 HIGH MS06-001 0
      96574 HIGH MS05-053 0
      93395 HIGH MS05-051 0
      93394 HIGH MS05-050 0
      93454 MEDIUM MS05-049 0
      ;===================================================================================================================================================================================






    • KatanaKatana
      edited April 2009
      How are things running ?


      Custom CFScript
      • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
        File::
C:\Program Files\WinRAR\patch.exe
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53111487-59a6-11dc-9d09-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64b1f2f0-6bb1-11dd-8828-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8038a1be-b699-11dc-8718-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8c963bd6-f560-11dc-879b-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4d07b3b-db84-11dc-8774-001b24512d8b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be109eee-93e9-11dd-889d-001b24512d8b}]
ADS::
      • Save this as CFScript.txt and place it on your desktop.


        CFScriptb.gif


      • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
      • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
      • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.


      CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
      Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

      A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
      ComboFix SHOULD NOT be used unless requested by a forum helper
    • shikin5646
      edited April 2009
      thank you for reply my message

      here combofix log
      now my computer are free from virus???:smiles:

      if still have infected file, does it effect my laptop??:confused:

      ComboFix 09-04-15.08 - user 04/15/2009 22:44.3 - NTFSx86
      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.766.356 [GMT 8:00]
      Running from: c:\documents and settings\user\Desktop\ComboFix.exe
      Command switches used :: c:\documents and settings\user\Desktop\CFScript.txt
      AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
      FW: Kaspersky Internet Security *disabled*
      * Created a new restore point

      FILE ::
      c:\program files\WinRAR\patch.exe
      .

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      c:\program files\WinRAR\patch.exe

      .
      ((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
      .

      2009-04-14 01:39 . 2008-06-19 08:24 28544 ----a-w c:\windows\system32\drivers\pavboot.sys
      2009-04-11 07:00 . 2009-04-11 07:01
      d
      w C:\rsit
      2009-04-06 12:24 . 2009-04-06 12:24
      d
      w c:\documents and settings\user\.spss
      2009-04-06 12:17 . 2009-04-06 12:17 114 ----a-w c:\windows\system32\prsgrc.tgz
      2009-04-06 12:17 . 2009-04-06 12:17 1024 ----a-w c:\windows\system32\grcauth2.dll
      2009-04-06 12:17 . 2009-04-06 12:17 1024 ----a-w c:\windows\system32\grcauth1.dll
      2009-04-06 11:57 . 2009-04-06 11:57
      d
      w c:\documents and settings\All Users\Application Data\SafeNet Sentinel
      2009-04-06 11:54 . 2009-04-06 11:54
      d
      w c:\documents and settings\All Users\Application Data\SPSS
      2009-04-06 11:53 . 2009-04-06 11:53 16 ---h--w c:\windows\system32\servdat.slm
      2009-04-06 11:53 . 2009-04-06 11:53 219 ----a-w c:\windows\system32\lsprst7.tgz
      2009-04-06 11:53 . 2009-04-06 11:53 1025 ----a-w c:\windows\system32\sysprs7.tgz
      2009-04-06 11:53 . 2009-04-06 11:53 1025 ----a-w c:\windows\system32\sysprs7.dll
      2009-04-06 11:53 . 2009-04-06 11:53 0 ----a-w C:\law.sp
      2009-04-04 14:59 . 2009-04-08 13:32
      d
      w c:\documents and settings\user\Local Settings\Application Data\WMTools Downloaded Files
      2009-04-02 08:17 . 2008-08-26 01:26 18816 ----a-w c:\windows\system32\drivers\pccsmcfd.sys
      2009-04-02 08:16 . 2008-09-14 23:56 91136 ----a-w c:\windows\system32\nmwcdcls.dll
      2009-04-02 08:14 . 2009-04-02 08:14
      d
      w c:\documents and settings\All Users\Application Data\Installations
      2009-03-22 00:47 . 2009-03-22 00:47
      d
      w c:\documents and settings\All Users\Application Data\Zoom Player
      2009-03-22 00:33 . 2009-03-22 00:33
      d
      w c:\documents and settings\user\Application Data\GRETECH

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2009-04-15 14:44 . 2009-01-09 07:35 417824 --sha-w c:\windows\system32\drivers\fidbox2.dat
      2009-04-15 14:44 . 2009-01-09 07:35 417824 --sha-w c:\windows\system32\drivers\fidbox2.dat
      2009-04-15 14:44 . 2009-01-09 07:35 3556 --sha-w c:\windows\system32\drivers\fidbox2.idx
      2009-04-15 14:14 . 2007-12-03 14:13
      d
      w c:\documents and settings\All Users\Application Data\Kaspersky Lab
      2009-04-14 16:36 . 2009-01-09 07:35 27276 --sha-w c:\windows\system32\drivers\fidbox.idx
      2009-04-14 16:36 . 2009-01-09 07:35 2548256 --sha-w c:\windows\system32\drivers\fidbox.dat
      2009-04-14 16:36 . 2009-01-09 07:35 2548256 --sha-w c:\windows\system32\drivers\fidbox.dat
      2009-04-14 16:35 . 2008-09-04 11:14 268 ---ha-w C:\sqmdata19.sqm
      2009-04-14 16:35 . 2008-09-04 11:14 244 ---ha-w C:\sqmnoopt19.sqm
      2009-04-14 05:34 . 2008-09-02 05:36 268 ---ha-w C:\sqmdata18.sqm
      2009-04-14 05:34 . 2008-09-02 05:36 244 ---ha-w C:\sqmnoopt18.sqm
      2009-04-14 01:35 . 2009-04-14 01:35
      d
      w c:\program files\Panda Security
      2009-04-13 06:23 . 2008-09-01 19:07 268 ---ha-w C:\sqmdata17.sqm
      2009-04-13 06:23 . 2008-09-01 19:07 244 ---ha-w C:\sqmnoopt17.sqm
      2009-04-12 10:19 . 2008-09-01 04:23 268 ---ha-w C:\sqmdata16.sqm
      2009-04-12 10:19 . 2008-09-01 04:23 244 ---ha-w C:\sqmnoopt16.sqm
      2009-04-11 16:12 . 2008-08-31 21:10 268 ---ha-w C:\sqmdata15.sqm
      2009-04-11 16:12 . 2008-08-31 21:10 244 ---ha-w C:\sqmnoopt15.sqm
      2009-04-11 15:45 . 2008-08-31 17:54 268 ---ha-w C:\sqmdata14.sqm
      2009-04-11 15:45 . 2008-08-31 17:54 244 ---ha-w C:\sqmnoopt14.sqm
      2009-04-11 14:41 . 2008-05-24 04:11
      d
      w c:\program files\BitLord
      2009-04-11 07:25 . 2008-08-31 05:03 268 ---ha-w C:\sqmdata13.sqm
      2009-04-11 07:25 . 2008-08-31 05:03 244 ---ha-w C:\sqmnoopt13.sqm
      2009-04-11 07:00 . 2009-04-11 07:00
      d
      w c:\program files\trend micro
      2009-04-10 14:47 . 2008-08-31 00:17 268 ---ha-w C:\sqmdata12.sqm
      2009-04-10 14:47 . 2008-08-31 00:17 244 ---ha-w C:\sqmnoopt12.sqm
      2009-04-10 05:02 . 2008-08-29 07:04 268 ---ha-w C:\sqmdata11.sqm
      2009-04-10 05:02 . 2008-08-29 07:04 244 ---ha-w C:\sqmnoopt11.sqm
      2009-04-10 01:00 . 2008-08-29 04:06 268 ---ha-w C:\sqmdata10.sqm
      2009-04-10 01:00 . 2008-08-29 04:06 244 ---ha-w C:\sqmnoopt10.sqm
      2009-04-09 14:31 . 2008-08-28 20:41 268 ---ha-w C:\sqmdata09.sqm
      2009-04-09 14:31 . 2008-08-28 20:41 244 ---ha-w C:\sqmnoopt09.sqm
      2009-04-08 15:30 . 2008-08-28 06:40 268 ---ha-w C:\sqmdata08.sqm
      2009-04-08 15:30 . 2008-08-28 06:40 244 ---ha-w C:\sqmnoopt08.sqm
      2009-04-07 22:52 . 2008-08-27 22:27 268 ---ha-w C:\sqmdata07.sqm
      2009-04-07 22:52 . 2008-08-27 22:27 244 ---ha-w C:\sqmnoopt07.sqm
      2009-04-07 15:43 . 2008-08-27 00:00 268 ---ha-w C:\sqmdata06.sqm
      2009-04-07 15:43 . 2008-08-27 00:00 244 ---ha-w C:\sqmnoopt06.sqm
      2009-04-07 10:43 . 2008-08-26 07:24 268 ---ha-w C:\sqmdata05.sqm
      2009-04-07 10:43 . 2008-08-26 07:24 244 ---ha-w C:\sqmnoopt05.sqm
      2009-04-06 16:57 . 2008-08-26 06:19 268 ---ha-w C:\sqmdata04.sqm
      2009-04-06 16:57 . 2008-08-26 06:19 244 ---ha-w C:\sqmnoopt04.sqm
      2009-04-06 13:29 . 2007-08-16 02:52 69744 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
      2009-04-06 11:54 . 2009-04-06 11:54
      d
      w c:\program files\Common Files\SPSS
      2009-04-06 11:54 . 2009-04-06 11:54
      d
      w c:\program files\SPSSInc
      2009-04-05 17:13 . 2008-08-26 05:51 268 ---ha-w C:\sqmdata03.sqm
      2009-04-05 17:13 . 2008-08-26 05:51 244 ---ha-w C:\sqmnoopt03.sqm
      2009-04-04 18:58 . 2008-08-25 18:08 268 ---ha-w C:\sqmdata02.sqm
      2009-04-04 18:58 . 2008-08-25 18:08 244 ---ha-w C:\sqmnoopt02.sqm
      2009-04-04 18:51 . 2008-08-21 20:05 268 ---ha-w C:\sqmdata01.sqm
      2009-04-04 18:51 . 2008-08-21 20:05 244 ---ha-w C:\sqmnoopt01.sqm
      2009-04-04 11:47 . 2007-08-16 03:12 268 ---ha-w C:\sqmdata00.sqm
      2009-04-04 11:47 . 2007-08-16 03:12 244 ---ha-w C:\sqmnoopt00.sqm
      2009-04-02 13:27 . 2007-08-16 03:04
      d
      w c:\program files\Google
      2009-04-02 08:17 . 2009-04-02 08:16
      d
      w c:\program files\Nokia
      2009-04-02 08:17 . 2009-04-02 08:17
      d
      w c:\program files\DIFX
      2009-04-02 08:16 . 2009-04-02 08:16
      d
      w c:\program files\PC Connectivity Solution
      2009-03-22 01:06 . 2009-03-22 01:06
      d
      w c:\program files\MONOGRAM AMR SplitterDecoder
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\CD Audio Reader Filter
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\DScaler5
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\OpenSource Flash Video Splitter
      2009-03-22 01:05 . 2009-03-22 01:05
      d
      w c:\program files\RealMedia
      2009-03-22 01:01 . 2009-03-22 00:47
      d
      w c:\program files\Zoom Player
      2009-03-22 00:52 . 2009-03-22 00:52
      d
      w c:\program files\SHOUTcast Source
      2009-03-22 00:52 . 2009-03-22 00:52
      d
      w c:\program files\Haali
      2009-03-22 00:52 . 2009-03-22 00:52
      d
      w c:\program files\DSP-worx
      2009-03-22 00:49 . 2009-03-22 00:49
      d
      w c:\program files\DirectVobSub
      2009-03-22 00:32 . 2009-03-22 00:32
      d
      w c:\program files\GRETECH
      2009-03-20 12:23 . 2007-12-11 18:37
      d
      w c:\documents and settings\All Users\Application Data\Yahoo! Companion
      2009-03-16 15:46 . 2008-01-09 04:24
      d
      w c:\documents and settings\All Users\Application Data\Microsoft Help
      .
      Sigcheck

      [-] 2004-08-03 16:56 690176 3A5EE0514F56B1B775D7641CFBA5AD37 c:\windows\system32\wininet.dll
      [-] 2004-08-03 16:56 690176 3A5EE0514F56B1B775D7641CFBA5AD37 c:\windows\system32\dllcache\wininet.dll

      [7] 2004-08-03 15:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\system32\dllcache\tcpip.sys
      [-] 2004-08-03 15:14 359040 6A603809F598332DBEDD535BDBCE313E c:\windows\system32\drivers\tcpip.sys

      [-] 2004-08-03 16:56 974336 A5C1F2CF7C31874E66478910B43D6513 c:\windows\explorer.exe
      [-] 2004-08-03 16:56 974336 A5C1F2CF7C31874E66478910B43D6513 c:\windows\system32\dllcache\explorer.exe

      [-] 2004-08-03 16:56 100864 80CB133BD6C830E8CA7E90015E45C1CD c:\windows\system32\wuauclt.exe
      [-] 2004-08-03 16:56 100864 80CB133BD6C830E8CA7E90015E45C1CD c:\windows\system32\dllcache\wuauclt.exe
      .
      ((((((((((((((((((((((((((((( SnapShot@2009-04-14_ 9.25.49.53 )))))))))))))))))))))))))))))))))))))))))
      .
      + 2009-04-14 01:39 . 2008-06-19 08:24 28544 c:\windows\system32\drivers\pavboot.sys
      + 2009-01-09 07:35 . 2009-04-15 14:44 417824 c:\windows\system32\drivers\fidbox2.dat
      + 2009-01-09 07:35 . 2009-04-14 16:36 2548256 c:\windows\system32\drivers\fidbox.dat
      .
      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-12 68856]
      "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
      "Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
      "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
      "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-01-08 4363504]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2007-07-20 53248]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-20 860160]
      "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-20 707344]
      "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-20 8429568]
      "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-20 81920]
      "PLFSet"="c:\windows\PLFSet.dll" [2007-04-24 45056]
      "WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-10-10 36352]
      "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
      "Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
      "DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2007-07-04 45056]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
      "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-26 185872]
      "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 206088]
      "mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
      "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-20 16132608]
      "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-07-20 1626112]

      c:\documents and settings\user\Start Menu\Programs\Startup\
      Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-17 113664]
      OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]
      RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]
      UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]

      [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
      "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
      2008-07-23 23:28 352256 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "msacm.divxa32"= msaud32_divx.acm

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
      path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
      backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

      [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
      path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
      backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
      2007-07-25 10:22 1998896 ----a-w c:\program files\FlashGet\flashget.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
      2007-01-19 19:54 5674352 ----a-w c:\program files\MSN Messenger\msnmsgr.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
      2001-07-09 18:50 155648 ----a-w c:\windows\system32\NeroCheck.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
      2004-11-03 03:24 32768 ----a-w c:\program files\CyberLink\PowerDVD\PDVDServ.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
      2006-07-21 20:06 20036648 ----a-w c:\program files\Skype\Phone\Skype.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
      2006-11-26 18:30 97357 ----a-w c:\program files\Ringz Studio\Storm Codec\StormSet.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
      2009-01-08 11:38 4363504 ----a-w c:\program files\Yahoo!\Messenger\YahooMessenger.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
      "AntiVirusDisableNotify"=dword:00000001
      "UpdatesDisableNotify"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "c:\\Program Files\\FlashGet\\flashget.exe"=
      "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
      "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
      "c:\\Program Files\\MSN Messenger\\livecall.exe"=
      "c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
      "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
      "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
      "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
      "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
      "c:\\Program Files\\SPSSInc\\SPSS16\\spss.exe"=
      "c:\\Program Files\\SPSSInc\\SPSS16\\spss.com"=
      "c:\\Program Files\\SPSSInc\\SPSS16\\SPSSWinWrapIDE.exe"=

      R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2007-05-08 5632]
      R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]
      R3 winbondhidcir;Winbond HID CIR Receiver;c:\windows\system32\DRIVERS\winbondhidcir.sys [2007-05-08 21504]
      S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-05 33808]
      S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544]
      S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-09-03 8944]
      S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-09-03 55024]
      S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
      S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]


      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
      \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
      \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41b63bbc-de2a-11dd-8926-001b24512d8b}]
      \Shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe
      .
      .
      Supplementary Scan
      .
      uStart Page = hxxp://www.yahoo.com/
      uSearch Page = hxxp://www.google.com
      uSearch Bar = hxxp://www.google.com/ie
      mStart Page = hxxp://www.yahoo.com/
      mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
      uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
      IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm
      IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm
      IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
      IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
      IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
      IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
      IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
      IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
      FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\xk8k3oew.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
      FF - prefs.js: browser.search.selectedEngine - Google
      FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
      FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
      FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
      FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
      .

      **************************************************************************

      catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2009-04-15 22:50
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************
      .
      DLLs Loaded Under Running Processes

      - - - - - - - > 'winlogon.exe'(1188)
      c:\program files\SUPERAntiSpyware\SASWINLO.dll
      .
      Completion time: 2009-04-15 22:54
      ComboFix-quarantined-files.txt 2009-04-15 14:54
      ComboFix2.txt 2009-04-14 01:28
      ComboFix3.txt 2009-04-12 00:48

      Pre-Run: 15,796,432,896 bytes free
      Post-Run: 15,787,012,096 bytes free

      267
    • KatanaKatana
      edited April 2009
      shikin5646 wrote:
      now my computer are free from virus??
      Your logs look fine now,
      shikin5646 wrote:
      if still have infected file, does it effect my laptop??:confused:
      I'm not sure what you mean by this ?

      You had a Flash/USB infection, if you used the USB drive on another machine than that may also be infected.
    • shikin5646
      edited April 2009
      orait!!!... thanks for helping me:smiles:
    • KatanaKatana
      edited April 2009
      Congratulations your logs look clean :)

      Let's see if I can help you keep it that way

      First lets tidy up

      Please delete RSIT.exe and C:\RSIT (entire folder)
      You can also delete any logs we have produced, and empty your Recycle bin.


      Uninstall Combofix
      • This will clear your System Volume Information restore points and remove all the infected files that were quarantined
      • Click START then RUN
      • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
        • CF_Cleanup.png


      The following is some info to help you stay safe and clean.


      You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
      ( Vista users must ensure that any programs are Vista compatible BEFORE installing )

      Online Scanners
      I would recommend a scan at one or more of the following sites at least once a month.

      http://www.pandasecurity.com/activescan
      http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

      !!! Make sure that all your programs are updated !!!
      Secunia Software Inspector does all the work for you, .... see HERE for details

      AntiSpyware
        AntiSpyware is
      not the same thing as Antivirus.
      Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
      You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
      Most of the programs in this list have a free (for Home Users ) and paid versions,
      it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
      [*]Spybot - Search & Destroy <<< A must have program
      • It includes host protection and registry protection
      • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites

      [*] MalwareBytes Anti-malware <<< A New and effective program
      [*]a-squared Free <<< A good "realtime" or "on demand" scanner
      [*]superantispyware <<< A good "realtime" or "on demand" scanner



      Prevention
        These programs don't detect malware, they help stop it getting on your machine in the first place. Each does a different job, so you can have more than one
      • Winpatrol
        • An excellent startup manager and then some !!
        • Notifies you if programs are added to startup
        • Allows delayed startup
        • A must have addition
      • SpywareBlaster 4.0
        • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
      • SpywareGuard 2.2
        • SpywareGuard provides real-time protection against spyware.
        • Not required if you have other "realtime" antispyware or Winpatrol
      • ZonedOut
        • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
      • MVPS HOSTS
        • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
        • For information on how to download and install, please read this tutorial by WinHelp2002.
        • Not required if you are using other host file protections


      Internet Browsers
        Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys. Using a different web browser can help stop malware getting on your machine.
      • Make your Internet Explorer more secure - This can be done by following these simple instructions:
        1. From within Internet Explorer click on the Tools menu and then click on Options.
        2. Click once on the Security tab
        3. Click once on the Internet icon so it becomes highlighted.
        4. Click once on the Custom Level button.
          • Change the Download signed ActiveX controls to Prompt
          • Change the Download unsigned ActiveX controls to Disable
          • Change the Initialise and script ActiveX controls not marked as safe to Disable
          • Change the Installation of desktop items to Prompt
          • Change the Launching programs and files in an IFRAME to Prompt
          • Change the Navigate sub-frames across different domains to Prompt
          • When all these settings have been made, click on the OK button.
          • If it prompts you as to whether or not you want to save the settings, press the Yes button.
        5. Next press the Apply button and then the OK to exit the Internet Properties page.

      If you are still using IE6 then either update, or get one of the following.
      • FireFox
        • With many addons available that make customization easy this is a very popular choice
        • NoScript and AdBlockPlus addons are essential
      • Opera
        • Another popular alternative
      • Netscape
        • Another popular alternative
        • Also has Addons available



      Cleaning Temporary Internet Files and Tracking Cookies
        Temporary Internet Files are mainly the files that are downloaded when you open a web page. Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware. It is a good idea to empty the Temporary Internet Files folder on a regular basis. Tracking Cookies are files that websites use to monitor which sites you visit and how often. A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted. CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords Both of these can be cleaned manually, but a quicker option is to use a program
      • ATF Cleaner
        • Free and very simple to use
      • CCleaner
        • Free and very flexible, you can chose which cookies to keep


      Also PLEASE read this article.....So How Did I Get Infected In The First Place

      The last and most important thing I can tell you is UPDATE.
      If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
      Malware changes on a day to day basis. You should update every week at the very least.

      If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


      If you could post back one more time to let me know everything is OK, then I can have this thread archived.

      Happy surfing K'
    • shikin5646
      edited April 2009
      everything is ok!!!:D

      thank you so much.....
    Sign In or Register to comment.