mayi..i need your help again T_T

• rpgragnarok

  18 Jan 08, 20:00

  arghhh..seems like another thumbdrive virus.. this time its called obtusfad.aeix.. copetttt.com.. .dunno wad is it , but its in my microSD card. my avg always detect the virus when i double click open it.
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 8:02:23 PM, on 18/01/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
  C:\WINDOWS\system32\wbem\unsecapp.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\DOCUME~1\p0713160\LOCALS~1\Temp\RtkBtMnt.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
  C:\WINDOWS\system32\igfxsrvc.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sp.edu.sg/
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lavasoft.de/help/aw/evhelp/0.htm
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
  O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
  O4 - Global Startup: Bluetooth.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170669123703
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
  O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
  O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  
  --
  End of file - 8764 bytes
  
• manyu882

  18 Jan 08, 20:23

  wah hijack this again.. lol.. mayi's job..
• rpgragnarok

  18 Jan 08, 20:27

  ahh..nevermind, i reformated my microSD , but i would really need advice on how to stop my spreading of virus... cause for my studies, friends usually exchange thumbdrives to exchange files..so i would like to know if theres any prevention to stop those viruses.
• ndmmxiaomayi

  18 Jan 08, 20:32

  If you already have Combofix, please delete this copy and download it again as it's being updated regularly.
  
  Please download Combofix from Bleeping Computer. Save it to your desktop.
  
  If you can't download it, please try these 2 alternative sites:
  
  Forospyware
  Geeks to Go
  
  Double click to run it. Follow the prompts. Once done, it will reboot and a log will be produced. Please post that log and a new HijackThis log in your next reply.
  
  Do not mouse click on Combofix while it is running. That may cause it to stall.
  
  Post back this Combofix log and a new HijackThis log.
• LatecomerX

  18 Jan 08, 20:44

  Originally posted by rpgragnarok:

  ahh..nevermind, i reformated my microSD , but i would really need advice on how to stop my spreading of virus... cause for my studies, friends usually exchange thumbdrives to exchange files..so i would like to know if theres any prevention to stop those viruses.

  Disable auto-run on all drives and run a lightweight real-time anti-virus scan like Kaspersky.
  
• ndmmxiaomayi

  18 Jan 08, 20:53

  Previously, I had him disabled autorun on all drives. I've got no idea autorun devices infected him again.
  
  Also, the fix created a dummy autorun.inf that is not so easily removed. Unless malwares have changed... I've got to ping the developer for more stubborn fixes.
• rpgragnarok

  19 Jan 08, 00:08

  ComboFix 08-01-18.4 - p0713160 2008-01-19 0:02:27.4 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2369 [GMT 8:00]
  Running from: C:\Documents and Settings\p0713160\Desktop\ComboFix.exe
  
  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
  .
  
  ((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))
  .
  
  2008-01-17 18:24 . 2008-01-17 18:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn
  2008-01-17 18:24 . 2008-01-17 18:24 1,409 --a------ C:\WINDOWS\QTFont.for
  2008-01-11 20:12 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf
  2008-01-07 20:58 . 2008-01-07 20:58 d-------- C:\WINDOWS\system32\Kaspersky Lab
  2008-01-07 20:58 . 2008-01-07 20:58 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
  2008-01-06 21:24 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
  2008-01-06 21:03 . 2008-01-06 21:03 d-------- C:\Program Files\Trend Micro
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-01-18 14:35 --------- d-----w C:\Documents and Settings\p0713160\Application Data\AVG7
  2008-01-18 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
  2008-01-18 13:15 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
  2008-01-18 12:44 --------- d-----w C:\Documents and Settings\p0713160\Application Data\Azureus
  2008-01-18 12:44 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Azureus
  2008-01-18 12:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
  2008-01-18 11:44 --------- d-----w C:\Documents and Settings\p0713160\Application Data\MyPhoneExplorer
  2008-01-11 15:06 --------- d-----w C:\Program Files\Wavosaur
  2007-12-31 16:48 --------- d-----w C:\Program Files\Azureus
  2007-12-30 10:36 --------- d-----w C:\Program Files\Warcraft III
  2007-12-22 11:03 --------- d-----w C:\Program Files\softnyx
  2007-12-20 10:00 --------- d-----w C:\Program Files\mIRC
  2007-12-14 12:49 --------- d-----w C:\Program Files\Windows Media Connect 2
  2007-12-14 12:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Grisoft
  2007-12-14 12:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AVG7
  2007-12-13 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
  2007-12-13 17:07 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7
  2007-12-13 17:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
  2007-12-13 16:53 --------- d-----w C:\Documents and Settings\p0713160\Application Data\Grisoft
  2007-12-13 15:59 --------- d-----w C:\Program Files\Microsoft Bootvis
  2007-12-13 13:46 --------- d-----w C:\Program Files\Lavasoft
  2007-12-13 13:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
  2007-12-13 13:44 --------- d-----w C:\Documents and Settings\p0713160\Application Data\Lavasoft
  2007-12-12 23:38 4,407,684 ----a-w C:\Documents and Settings\p0713160\TRACE_BOOT+DRIVERS_1_1.BIN
  2007-12-12 23:38 4,407,684 ----a-w C:\Documents and Settings\Default User\TRACE_BOOT+DRIVERS_1_1.BIN
  2007-12-10 16:57 --------- d-----w C:\Program Files\Launch Manager
  2007-12-09 01:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
  2007-12-07 11:07 --------- d-----w C:\Program Files\EClea2_0
  2007-12-07 11:06 --------- d-----w C:\Program Files\CCleaner
  2007-12-06 15:01 --------- d-----w C:\Program Files\Reference Assemblies
  2007-12-04 07:32 --------- d-----w C:\Documents and Settings\p0713160\Application Data\U3
  2007-11-19 15:51 --------- d-----w C:\Program Files\DivX
  2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
  2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
  2007-10-27 09:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
  2007-10-23 17:47 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll
  2007-10-23 17:47 84,480 ----a-w C:\WINDOWS\system32\mscories.dll
  2007-10-23 17:47 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll
  2007-10-23 17:47 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50 139320]
  "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-11-27 16:28 458752]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-29 06:13 766041]
  "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00 94208]
  "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 11:12 16062464 C:\WINDOWS\RTHDCPL.exe]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-06 10:45 155648]
  "Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48 147514]
  "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-11-08 10:28 802816]
  "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-11-08 10:22 696320]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-01-13 09:47 163840]
  "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584]
  "AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 21:50 88204 C:\WINDOWS\AGRSMMSG.exe]
  "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-06-07 20:18 208896]
  "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 17:25 6731312]
  "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 08:57 579072]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
  "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-14 01:07 219136]
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
  path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
  backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MapToPDriveLoopLaunch.bat]
  path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MapToPDriveLoopLaunch.bat
  backup=C:\WINDOWS\pss\MapToPDriveLoopLaunch.batCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^p0713160^Start Menu^Programs^Startup^Adobe Gamma.lnk]
  path=C:\Documents and Settings\p0713160\Start Menu\Programs\Startup\Adobe Gamma.lnk
  backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWMON]
  C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
  --a------ 2004-08-04 20:00 15360 C:\WINDOWS\system32\ctfmon.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
  --a------ 2006-06-01 14:40 413696 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
  --a------ 2007-01-13 09:47 131072 C:\WINDOWS\system32\igfxtray.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
  --a------ 2004-08-04 20:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
  --a------ 2005-12-20 20:54 278528 C:\Program Files\iTunes\iTunesHelper.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
  --a------ 2006-07-14 12:13 471040 C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
  --a------ 2006-11-28 18:38 244512 C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
  --a------ 2004-08-04 20:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
  --a------ 2006-05-15 11:15 45056 C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
  --a------ 2006-06-12 16:11 7577600 C:\WINDOWS\system32\NvCpl.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
  --a------ 2006-06-12 16:11 86016 C:\WINDOWS\system32\NvMcTray.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
  --a------ 2006-06-12 16:11 1519616 C:\WINDOWS\system32\nwiz.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
  --a------ 2007-01-13 09:46 135168 C:\WINDOWS\system32\igfxpers.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
  --a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
  --a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
  --a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
  --a------ 2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  --a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
  "WMPNetworkSvc"=3 (0x3)
  "WLANKEEPER"=2 (0x2)
  "S24EventMonitor"=2 (0x2)
  "RPCSE"=2 (0x2)
  "RegSrvc"=2 (0x2)
  "RaySat_3dsmax8Server"=2 (0x2)
  "ose"=3 (0x3)
  "NVSvc"=2 (0x2)
  "MDM"=2 (0x2)
  "LVSrvLauncher"=2 (0x2)
  "LightScribeService"=2 (0x2)
  "iPodService"=3 (0x3)
  "idsvc"=3 (0x3)
  "IDriverT"=3 (0x3)
  "EvtEng"=2 (0x2)
  "Autodesk Licensing Service"=2 (0x2)
  "Adobe LM Service"=3 (0x3)
  
  R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
  R2 CcmExec;SMS Agent Host;C:\WINDOWS\system32\CCM\CcmExec.exe [2006-02-09 02:50]
  R2 int15;int15;C:\WINDOWS\system32\drivers\int15.sys [2006-06-02 13:59]
  R2 tvicport;tvicport;C:\WINDOWS\system32\drivers\tvicport.sys [2006-06-02 13:59]
  R3 prepdrvr;SMS Process Event Driver;C:\WINDOWS\system32\CCM\prepdrv.sys [2006-02-09 02:50]
  R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC);C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2007-01-12 17:34]
  S3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys [2006-11-28 18:36]
  S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 14:58]
  S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 14:58]
  S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 14:58]
  S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 14:58]
  S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 14:58]
  S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 14:58]
  S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 14:58]
  S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" [2005-09-23 07:01]
  S4 RaySat_3dsmax8Server;RaySat_3dsmax8 Server;C:\Program Files\Autodesk\VIZ2007\mentalray\satellite\raysat_3dsmax8server.exe []
  S4 RPCSE;Remote Procedure Call (RPC) MO;C:\Program Files\Intel\Intel []
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0fac23ee-82b3-11dc-8dc8-0019d203273b}]
  \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL taipingtianguo.exe
  \Shell\´ò¿ª\command - F:\taipingtianguo.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eb475a8-2aab-11dc-8ce3-0019d203273b}]
  \Shell\AutoRun\command - G:\Launch.exe
  
  *Newly Created Service* - ENTDRV51
  .
  **************************************************************************
  
  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-01-19 00:04:38
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-01-19 0:05:06
  ComboFix-quarantined-files.txt 2008-01-18 16:05:03
  ComboFix2.txt 2008-01-18 11:17:53
  .
  2008-01-09 12:14:14 --- E O F ---
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 12:10:32 AM, on 19/01/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\DOCUME~1\p0713160\LOCALS~1\Temp\RtkBtMnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\wbem\unsecapp.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sp.edu.sg/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lavasoft.de/help/aw/evhelp/0.htm
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
  O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
  O4 - Global Startup: Bluetooth.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170669123703
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
  O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
  O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  
  --
  End of file - 8680 bytes
  
• ndmmxiaomayi

  20 Jan 08, 00:23

  Hmm... missed your log yesterday.
  
  Copy and paste the following in blue into Notepad.
  
  Registry::
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0fac23ee-82b3-11dc-8dc8-0019d203273b}]
  
  Save it as CFScript.txt. Do not change the file name.
  
  Drag CFScript into Combofix. Combofix will start running. When done, a log will be produced.
  
  Do not mouse click on Combofix while it is running. That may cause it to stall.
  
  Next...
  
  

  [*]Please download Flash_Disinfector and save it to your desktop.
  [*]Double click to run it.
  [*]You will be prompted to plug in your flash drive. Plug it in.
  [*]Flash_Disinfector will start disinfecting your flash and hard drives. This takes a few seconds. Your desktop will disappear in the meantime.
  [*]When done, a message box will appear. Click OK. Your desktop should now appear. If it doesn't, press Ctrl + Shift + Esc to open Task Manager.
  [*]Click on File > New Task (Run...). Type in explorer.exe and press Enter. Your desktop should now appear.

  
  
  Post back the Combofix log and a new HijackThis log.
• rpgragnarok

  20 Jan 08, 01:05

  ComboFix 08-01-18.4 - p0713160 2008-01-20 1:01:52.5 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2415 [GMT 8:00]
  Running from: C:\Documents and Settings\p0713160\Desktop\ComboFix.exe
  Command switches used :: C:\Documents and Settings\p0713160\Desktop\CFScript.txt
  * Created a new restore point
  
  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
  .
  
  ((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
  .
  
  2008-01-17 18:24 . 2008-01-17 18:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn
  2008-01-17 18:24 . 2008-01-17 18:24 1,409 --a------ C:\WINDOWS\QTFont.for
  2008-01-11 20:12 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf
  2008-01-07 20:58 . 2008-01-07 20:58 d-------- C:\WINDOWS\system32\Kaspersky Lab
  2008-01-07 20:58 . 2008-01-07 20:58 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
  2008-01-06 21:24 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
  2008-01-06 21:03 . 2008-01-06 21:03 d-------- C:\Program Files\Trend Micro
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-01-19 06:03 --------- d-----w C:\Documents and Settings\p0713160\Application Data\AVG7
  2008-01-18 13:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
  2008-01-18 13:15 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
  2008-01-18 12:44 --------- d-----w C:\Documents and Settings\p0713160\Application Data\Azureus
  2008-01-18 12:44 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Azureus
  2008-01-18 12:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
  2008-01-18 11:44 --------- d-----w C:\Documents and Settings\p0713160\Application Data\MyPhoneExplorer
  2008-01-11 15:06 --------- d-----w C:\Program Files\Wavosaur
  2007-12-31 16:48 --------- d-----w C:\Program Files\Azureus
  2007-12-30 10:36 --------- d-----w C:\Program Files\Warcraft III
  2007-12-22 11:03 --------- d-----w C:\Program Files\softnyx
  2007-12-20 10:00 --------- d-----w C:\Program Files\mIRC
  2007-12-14 12:49 --------- d-----w C:\Program Files\Windows Media Connect 2
  2007-12-14 12:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Grisoft
  2007-12-14 12:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AVG7
  2007-12-13 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
  2007-12-13 17:07 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7
  2007-12-13 17:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
  2007-12-13 16:53 --------- d-----w C:\Documents and Settings\p0713160\Application Data\Grisoft
  2007-12-13 15:59 --------- d-----w C:\Program Files\Microsoft Bootvis
  2007-12-13 13:46 --------- d-----w C:\Program Files\Lavasoft
  2007-12-13 13:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
  2007-12-13 13:44 --------- d-----w C:\Documents and Settings\p0713160\Application Data\Lavasoft
  2007-12-12 23:38 4,407,684 ----a-w C:\Documents and Settings\p0713160\TRACE_BOOT+DRIVERS_1_1.BIN
  2007-12-12 23:38 4,407,684 ----a-w C:\Documents and Settings\Default User\TRACE_BOOT+DRIVERS_1_1.BIN
  2007-12-10 16:57 --------- d-----w C:\Program Files\Launch Manager
  2007-12-09 01:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
  2007-12-07 11:07 --------- d-----w C:\Program Files\EClea2_0
  2007-12-07 11:06 --------- d-----w C:\Program Files\CCleaner
  2007-12-06 15:01 --------- d-----w C:\Program Files\Reference Assemblies
  2007-12-04 07:32 --------- d-----w C:\Documents and Settings\p0713160\Application Data\U3
  2007-11-19 15:51 --------- d-----w C:\Program Files\DivX
  2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
  2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
  2007-10-27 09:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
  2007-10-23 17:47 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll
  2007-10-23 17:47 84,480 ----a-w C:\WINDOWS\system32\mscories.dll
  2007-10-23 17:47 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll
  2007-10-23 17:47 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-01-19_ 0.04.46.29 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-01-18 12:16:53 1,409,024 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
  + 2008-01-19 17:01:28 1,409,024 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
  - 2008-01-18 12:16:53 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
  + 2008-01-19 17:01:29 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
  - 2008-01-18 12:16:53 1,413,120 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
  + 2008-01-19 17:01:29 1,413,120 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
  - 2008-01-18 12:16:54 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
  + 2008-01-19 17:01:29 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
  - 2008-01-18 12:16:55 7,323,648 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
  + 2008-01-19 17:01:30 7,331,840 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
  - 2008-01-18 12:16:55 262,144 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
  + 2008-01-19 17:01:31 262,144 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
  + 2008-01-19 16:39:00 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_824.dat
  .
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50 139320]
  "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-11-27 16:28 458752]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-29 06:13 766041]
  "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00 94208]
  "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 11:12 16062464 C:\WINDOWS\RTHDCPL.exe]
  "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-06 10:45 155648]
  "Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48 147514]
  "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-11-08 10:28 802816]
  "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-11-08 10:22 696320]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-01-13 09:47 163840]
  "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584]
  "AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 21:50 88204 C:\WINDOWS\AGRSMMSG.exe]
  "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-06-07 20:18 208896]
  "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 17:25 6731312]
  "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 08:57 579072]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00 15360]
  "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-14 01:07 219136]
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
  path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
  backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MapToPDriveLoopLaunch.bat]
  path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MapToPDriveLoopLaunch.bat
  backup=C:\WINDOWS\pss\MapToPDriveLoopLaunch.batCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^p0713160^Start Menu^Programs^Startup^Adobe Gamma.lnk]
  path=C:\Documents and Settings\p0713160\Start Menu\Programs\Startup\Adobe Gamma.lnk
  backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWMON]
  C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
  --a------ 2004-08-04 20:00 15360 C:\WINDOWS\system32\ctfmon.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]
  --a------ 2006-06-01 14:40 413696 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
  --a------ 2007-01-13 09:47 131072 C:\WINDOWS\system32\igfxtray.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
  --a------ 2004-08-04 20:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
  --a------ 2005-12-20 20:54 278528 C:\Program Files\iTunes\iTunesHelper.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
  --a------ 2006-07-14 12:13 471040 C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
  --a------ 2006-11-28 18:38 244512 C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
  --a------ 2004-08-04 20:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI]
  --a------ 2006-05-15 11:15 45056 C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
  --a------ 2006-06-12 16:11 7577600 C:\WINDOWS\system32\NvCpl.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
  --a------ 2006-06-12 16:11 86016 C:\WINDOWS\system32\NvMcTray.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
  --a------ 2006-06-12 16:11 1519616 C:\WINDOWS\system32\nwiz.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
  --a------ 2007-01-13 09:46 135168 C:\WINDOWS\system32\igfxpers.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
  --a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
  --a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
  --a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
  --a------ 2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  --a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
  "WMPNetworkSvc"=3 (0x3)
  "WLANKEEPER"=2 (0x2)
  "S24EventMonitor"=2 (0x2)
  "RPCSE"=2 (0x2)
  "RegSrvc"=2 (0x2)
  "RaySat_3dsmax8Server"=2 (0x2)
  "ose"=3 (0x3)
  "NVSvc"=2 (0x2)
  "MDM"=2 (0x2)
  "LVSrvLauncher"=2 (0x2)
  "LightScribeService"=2 (0x2)
  "iPodService"=3 (0x3)
  "idsvc"=3 (0x3)
  "IDriverT"=3 (0x3)
  "EvtEng"=2 (0x2)
  "Autodesk Licensing Service"=2 (0x2)
  "Adobe LM Service"=3 (0x3)
  
  R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
  R2 CcmExec;SMS Agent Host;C:\WINDOWS\system32\CCM\CcmExec.exe [2006-02-09 02:50]
  R2 int15;int15;C:\WINDOWS\system32\drivers\int15.sys [2006-06-02 13:59]
  R2 tvicport;tvicport;C:\WINDOWS\system32\drivers\tvicport.sys [2006-06-02 13:59]
  R3 prepdrvr;SMS Process Event Driver;C:\WINDOWS\system32\CCM\prepdrv.sys [2006-02-09 02:50]
  R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC);C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2007-01-12 17:34]
  S3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\DRIVERS\lv321av.sys [2006-11-28 18:36]
  S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 14:58]
  S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 14:58]
  S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 14:58]
  S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 14:58]
  S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 14:58]
  S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 14:58]
  S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 14:58]
  S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" [2005-09-23 07:01]
  S4 RaySat_3dsmax8Server;RaySat_3dsmax8 Server;C:\Program Files\Autodesk\VIZ2007\mentalray\satellite\raysat_3dsmax8server.exe []
  S4 RPCSE;Remote Procedure Call (RPC) MO;C:\Program Files\Intel\Intel []
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
  \Shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2eb475a8-2aab-11dc-8ce3-0019d203273b}]
  \Shell\AutoRun\command - G:\Launch.exe
  
  *Newly Created Service* - ENTDRV51
  .
  **************************************************************************
  
  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-01-20 01:03:40
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  .
  Completion time: 2008-01-20 1:04:10
  ComboFix-quarantined-files.txt 2008-01-19 17:04:08
  ComboFix2.txt 2008-01-18 16:05:06
  ComboFix3.txt 2008-01-18 11:17:53
  .
  2008-01-09 12:14:14 --- E O F ---
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 1:06:01 AM, on 20/01/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\DOCUME~1\p0713160\LOCALS~1\Temp\RtkBtMnt.exe
  C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  C:\WINDOWS\system32\wbem\unsecapp.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sp.edu.sg/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lavasoft.de/help/aw/evhelp/0.htm
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
  O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
  O4 - Global Startup: Bluetooth.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
  O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  
  --
  End of file - 7930 bytes
  
• ndmmxiaomayi

  20 Jan 08, 02:06

  Please download Ewido Micro Scanner and save it to your desktop.
  
  Double click to run it. It will start downloading the signatures. If your firewall prompts, please allow it.
  
  Once the signatures are downloaded, click on Start Scan.
  
  Once done, click on Save Report. Save it to your desktop.
  
  Please post back this log in your next reply.
• rpgragnarok

  20 Jan 08, 18:35

  __________________________________________________
  ewido anti-spyware online scanner
  http://www.ewido.net
  __________________________________________________
  
  Name: TrackingCookie.Information
  Path: :mozilla.67:C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\cookies.txt
  Risk: Medium
  
  Name: TrackingCookie.Information
  Path: :mozilla.79:C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\cookies.txt
  Risk: Medium
  
  
• ndmmxiaomayi

  20 Jan 08, 19:00

  Please go to Kaspersky website and perform an online antivirus scan. Please use Internet Explorer as it uses ActiveX.
  
  

  [*]Read through the requirements and privacy statement and click on Accept button.
  [*]It will start downloading and installing the scanner and virus definitions. You will be prompted to install an ActiveX from Kaspersky. Click Yes.
  [*]When the downloads have finished, click on Next button.
  [*]Click on Scan Settings button.
  [*]Select extended under Scan using the following antivirus database:
  [*]Check (tick) these boxes under Scan options:
  [*]Scan Archives
  [*]Scan Mail Bases
  [*]Click OK
  [*]Click on My Computer under Please select a target to scan:
  [*]Once the scan is complete it will display if your system has been infected. Click on Save as text button and save it to your desktop.
  [*]Copy and paste this log in your next reply.

  
  
  Post the Kaspersky log.
• rpgragnarok

  21 Jan 08, 09:05

  KASPERSKY ONLINE SCANNER REPORT
  Monday, 21 January, 2008 9:07:11 AM
  Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
  Kaspersky Online Scanner version: 5.0.98.0
  Kaspersky Anti-Virus database last update: 20/01/2008
  Kaspersky Anti-Virus database records: 524815
  Scan Settings
  Scan using the following antivirus database extended
  Scan Archives true
  Scan Mail Bases true
  Scan Target My Computer
  C:\
  D:\
  E:\
  Scan Statistics
  Total number of scanned objects 116232
  Number of viruses found 2
  Number of infected objects 3
  Number of suspicious objects 0
  Duration of the scan process 02:44:12
  
  Infected Object Name Virus Name Last Action
  C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20080120_Time-222107343_EnterceptExceptions.dat Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20080120_Time-222107343_EnterceptRules.dat Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_DBE-NB0713160.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_DBE-NB0713160.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
  C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\cert8.db Object is locked skipped
  C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\formhistory.dat Object is locked skipped
  C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\history.dat Object is locked skipped
  C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\key3.db Object is locked skipped
  C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\parent.lock Object is locked skipped
  C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\search.sqlite Object is locked skipped
  C:\Documents and Settings\p0713160\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\urlclassifier2.sqlite Object is locked skipped
  C:\Documents and Settings\p0713160\Cookies\index.dat Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\ApplicationHistory\ePower_DMC.exe.3ca0acde.ini.inuse Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\ApplicationHistory\ePresentation.exe.e70224e9.ini.inuse Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\pending.dat Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1650_BB48_50BB_2CFD\dfsr.db Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1650_BB48_50BB_2CFD\fsr.log Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1650_BB48_50BB_2CFD\fsrtmp.log Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_1650_BB48_50BB_2CFD\tmp.edb Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\real\members.stg Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\shadow\members.stg Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\Cache\_CACHE_001_ Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\Cache\_CACHE_002_ Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\Cache\_CACHE_003_ Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\Cache\_CACHE_MAP_ Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Application Data\Mozilla\Firefox\Profiles\gapt35al.Default User\XUL.mfl Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\History\History.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Temp\~DF7FDE.tmp Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Temp\~DF7FEB.tmp Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Temp\~DF8FFF.tmp Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Temp\~DF900C.tmp Object is locked skipped
  C:\Documents and Settings\p0713160\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\p0713160\ntuser.dat Object is locked skipped
  C:\Documents and Settings\p0713160\ntuser.dat.LOG Object is locked skipped
  C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.62 skipped
  C:\System Volume Information\_restore{0CCD9644-D39E-4420-B10D-C01657D7298C}\RP10\A0004301.dll Infected: Trojan-PSW.Win32.OnLineGames.oxz skipped
  C:\System Volume Information\_restore{0CCD9644-D39E-4420-B10D-C01657D7298C}\RP14\change.log Object is locked skipped
  C:\System Volume Information\_restore{0CCD9644-D39E-4420-B10D-C01657D7298C}\RP9\A0004190.dll Infected: Trojan-PSW.Win32.OnLineGames.oxz skipped
  C:\WINDOWS\CSC\00000001 Object is locked skipped
  C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
  C:\WINDOWS\SchedLgU.Txt Object is locked skipped
  C:\WINDOWS\SoftwareDistribution\EventCache\{6D66FB52-81E9-4AB8-89B1-FB36D044600D}.bin Object is locked skipped
  C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
  C:\WINDOWS\Sti_Trace.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\CcmExec.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\CertificateMaintenance.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\ClientIDManagerStartup.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\DataTransferService.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\execmgr.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\LocationServices.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\mtrmgr.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PatchInstall.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PatchUIMonitor.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PolicyAgent.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PolicyAgentProvider.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PolicyEvaluator.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\Scheduler.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\SrcUpdateMgr.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\StatusAgent.log Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CertificateMaintenanceEndpoint\00000025.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CertificateMaintenanceEndpoint\00000025.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CTMDTSReply\0000000C.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CTMDTSReply\0000000C.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\execmgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\execmgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\InventoryAgent\00000002.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\InventoryAgent\00000002.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ReplyLocations\0000000I.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ReplyLocations\0000000I.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ScheduledCleanup\0000002M.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ScheduledCleanup\0000002M.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\MtrMgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\MtrMgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PatchUIMonitor\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PatchUIMonitor\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_Cleanup\0000000U.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_Cleanup\0000000U.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyDownload\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyDownload\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyEvaluator\000000HC.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyEvaluator\000000HC.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReplyAssignments\0000000K.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReplyAssignments\0000000K.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_RequestAssignments\000000FK.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_RequestAssignments\000000FK.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReRequestPolicy\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReRequestPolicy\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\RemoteToolsAgent\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\RemoteToolsAgent\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SrcUpdateMgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SrcUpdateMgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SWMTRReportGen\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SWMTRReportGen\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UpdatesInstallMgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UpdatesInstallMgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UploadProtocol\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UploadProtocol\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\amp_[http]mp_locationmanager\0000002S.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\amp_[http]mp_locationmanager\0000002S.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_ddrendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_ddrendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_hinvendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_hinvendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_relayendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_relayendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_sinvendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_sinvendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_statusreceiver\00000002.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_statusreceiver\00000002.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_locationmanager\0000000S.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_locationmanager\0000000S.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_policymanager\000000ER.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_policymanager\000000ER.que Object is locked skipped
  C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\default Object is locked skipped
  C:\WINDOWS\system32\config\default.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SAM Object is locked skipped
  C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
  C:\WINDOWS\system32\config\software Object is locked skipped
  C:\WINDOWS\system32\config\software.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\system Object is locked skipped
  C:\WINDOWS\system32\config\system.LOG Object is locked skipped
  C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
  C:\WINDOWS\system32\h323log.txt Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
  C:\WINDOWS\Temp\Perflib_Perfdata_828.dat Object is locked skipped
  C:\WINDOWS\wiadebug.log Object is locked skipped
  C:\WINDOWS\wiaservc.log Object is locked skipped
  C:\WINDOWS\WindowsUpdate.log Object is locked skipped
  D:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped
  Scan process completed.
• ndmmxiaomayi

  21 Jan 08, 09:47

  Looks clean now.
  
  Any other issues?
  
  If no...
  
  Update Java. Uninstall all old versions first, then install the new version.
  
  http://java.sun.com/javase/downloads/index.jsp
  
  Scroll down Java Runtime Environment (JRE) 6 Update 4 and click on Download.
• rpgragnarok

  21 Jan 08, 21:19

  yeap, everything's good to go.. but the current problem now is i think that my friends thumbdrive might have virus.. so do i juz run the flash disinfector everytime they plug in the thumbdrive or is there any other solution??
• ndmmxiaomayi

  21 Jan 08, 22:10

  It shouldn't be able to affect you. Because Flash_Disinfector created a stubborn folder named autorun.inf. It has also disabled autorun...
  
  Here's what to do...
  
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Uncheck (untick) Hide extensions of known file types.
  [*]Uncheck (untick) Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Whenever you plug in a thumbdrive... remove any hidden EXE files.
  
  Hidden files are semi transparent.
  
  Also remove the autorun.inf file.
  
  Or if you prefer a safer method.
  
  1. Start > Run and type in cmd.exe
  
  2. Type in the drive letter of the thumbdrive (usually F). Command is X:, press Enter
  
  3. Type in dir /a:h and press Enter
  
  4. See the list of the files there
  
  5. Delete only autorun.inf and the hidden .EXE files. If unsure, post back the results.
• rpgragnarok

  21 Jan 08, 23:01

  hmmm... ok, thanks =D
  but does that means i have to run flash_disinfector everytime i plug in a new thumbdrive so that it creates the autorun.inf in it
  
  or
  
  is autorun.inf created in my hard disk so that i do not have to run flash_disinfector everytime i plug in a new thumbdrive?
  
  sorry for the confusion >.<
• ndmmxiaomayi

  22 Jan 08, 08:44

  No... you don't have to run flash_disinfector... unless you are infected.
  
  Anyway, that tool is updated on a pretty regular basis as well, if new variants are discovered. Please don't keep it, download only when needed so you will always have the updated version.