HIjack this

• 0petslave0

  12 Feb 08, 23:28

  Re all

   

  My brother had been using my computer for a long period of time without getting my approval.

   

   

  Now my computer is in a mess

   

   

  Below posted is my hijackthis log file

   

  Hope some pros would point out which one i should delete and advice. Thanks very much

   

  ogfile of Trend Micro HijackThis v2.0.2
  Scan saved at 11:26:59 PM, on 2/12/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16574)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\DigitalPersona\Bin\DpHost.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32 vsvc32.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32 undll32.exe
  C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Microsoft IntelliType Pro\type32.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\WINDOWS\system32\wupeng.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
  C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Opera\Opera.exe
  C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
  O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
  O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar esources\en-US\local\search.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin pjpi160_03.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin pjpi160_03.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
  O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
  O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32 vsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  --
  End of file - 9387 bytes
  
  

   

• ndmmxiaomayi

  13 Feb 08, 19:22

  I'll be back in a while to check.

• ndmmxiaomayi

  13 Feb 08, 20:49

  C:\WINDOWS\system32 undll32.exe

  This looks curious.

  Please go to Virus Total or Jotti and upload C:\WINDOWS\system32 undll32.exe for scanning.
  
  For Virus Total

  • Please copy and paste C:\WINDOWS\system32 undll32.exe in the text box next to the Browse button.
  • Click on Send File.

  
  For Jotti

  • Please copy and paste C:\WINDOWS\system32 undll32.exe in the text box next to the Browse button.
  • Click on Submit.

  ---

  If you already have Smitfraudfix, please delete this copy and download it again as it's being updated regularly.

  Please download SmitFraudFix.exe by S!Ri and save it to the desktop.

  If you can't download it, please download it from these alternative sites:

  http://siri.geekstogo.com/SmitfraudFix.exe

  http://downloads.securitycadets.com/SmitfraudFix.exe

  http://telechargement.zebulon.fr/259-smitfraudfix.html

  1. Double click on SmitfraudFix.exe.
  2. Press 1 then hit the Enter key.
  3. It will create a report named rapport.txt, usually at C drive.
  4. Please post back this log in your next reply.

  Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. http://www.beyondlogic.org/consulting/processutil/processutil.htm

  Post back

  1. Smitfraudfix report (C: apport.txt)

  2. Virus Total or Jotti's scan results of the file

  3. A new HijackThis log

• 0petslave0

  14 Feb 08, 05:26

   

   

   

  1) Smitfraudfix report:

   

  C:\Program Files\Helper\ FOUND !
  
  C:\Program Files\MalwareCrush\ FOUND !
  
  C:\Program Files\NetProject\ FOUND !
  
  C:\Program Files\Sotfone\ FOUND !
  
  C:\Program Files\VirusHeat 3.9\ FOUND !
  
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
  
  
  
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
  "Source"="About:Home"
  "SubscribedURL"="About:Home"
  "FriendlyName"="My Current Home Page"
  
  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
  !!!Attention, following keys are not inevitably infected!!!
  
  IEDFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» VACFix
  !!!Attention, following keys are not inevitably infected!!!
  
  VACFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{917f93bf-6714-4e11-8982-59db2e0f88fc}"="epistylar"
  
  [HKEY_CLASSES_ROOT\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}\InProcServer32]
  @="C:\WINDOWS\system32\eeioq.dll"
  
  [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}\InProcServer32]
  @="C:\WINDOWS\system32\eeioq.dll"
  
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLs"=""
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "System"=""
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Rustock
  
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS
  
  Description: Linksys Wireless-G USB Network Adapter - Packet Scheduler Miniport
  DNS Server Search Order: 218.186.1.88
  DNS Server Search Order: 202.156.1.68
  DNS Server Search Order: 202.156.1.48
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{53231809-B3C6-4430-BD3D-20774D0A0D81}: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS1\Services\Tcpip\..\{53231809-B3C6-4430-BD3D-20774D0A0D81}: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS2\Services\Tcpip\..\{53231809-B3C6-4430-BD3D-20774D0A0D81}: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» End
  
  
  
  2) I can't do the scan for both.

  
  
  

• 0petslave0

  14 Feb 08, 05:37

  SmitFraudFix v2.288
  
  Scan done at 5:27:39.17, Thu 02/14/2008
  Run from C:\Documents and Settings\Administrator\SmitfraudFix
  OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
  The filesystem type is NTFS
  Fix run in normal mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» Process
  
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\DigitalPersona\Bin\DpHost.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32 vsvc32.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\NetProject\sbmntr.exe
  C:\Program Files\NetProject\scit.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32 undll32.exe
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\NetProject\scm.exe
  C:\Program Files\NetProject\sbsm.exe
  C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
  C:\Program Files\Microsoft IntelliType Pro\type32.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
  C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Opera\Opera.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\system32\cmd.exe
  C:\WINDOWS\NOTEPAD.EXE
  
  »»»»»»»»»»»»»»»»»»»»»»»» hosts
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data
  
  C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareCrush 3.7.lnk FOUND !
  C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 3.9.lnk FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» Start Menu
  
  C:\DOCUME~1\ADMINI~1\STARTM~1\MalwareCrush 3.7.lnk FOUND !
  C:\DOCUME~1\ADMINI~1\STARTM~1\VirusHeat 3.9.lnk FOUND !
  C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\MalwareCrush FOUND !
  C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\VirusHeat 3.9 FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\FAVORI~1
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop
  
  C:\DOCUME~1\ADMINI~1\Desktop\MalwareCrush.lnk FOUND !
  C:\DOCUME~1\ADMINI~1\Desktop\VirusHeat 3.9.lnk FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  C:\Program Files\Helper\ FOUND !
  C:\Program Files\MalwareCrush\ FOUND !
  C:\Program Files\NetProject\ FOUND !
  C:\Program Files\Sotfone\ FOUND !
  C:\Program Files\VirusHeat 3.9\ FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
  "Source"="About:Home"
  "SubscribedURL"="About:Home"
  "FriendlyName"="My Current Home Page"
  
  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
  !!!Attention, following keys are not inevitably infected!!!
  
  
  

• ndmmxiaomayi

  14 Feb 08, 13:35

  No wonder it looks odd. Forum chopped off some slashes. -_-

  Actual file name (image) -

   

  Browse to this file and upload to either Virus Total or Jotti for a scan. Show hidden files and folders first as this file may be hidden. To show hidden files and folders, do the following:

  1. Open My Computer.
  2. Go to Tools > Folder Options.
  3. Select the View tab.
  4. Scroll down to Hidden files and folders.
  5. Select Show hidden files and folders.
  6. Uncheck (untick) Hide extensions of known file types.
  7. Uncheck (untick) Hide protected operating system files (Recommended).
  8. Click Yes when prompted.
  9. Click OK.
  10. Close My Computer.

  Please copy this set of instructions or print it out as you will not have internet access during the fix.
  
  Restart the computer in Safe Mode

  1. When you see the BIOS screen, start pressing F8.
  2. A boot menu will appear shortly.
  3. Using the up down arrows, select Safe Mode and press the Enter key.
  4. Windows will now load.
  5. Log in to your usual account.

  
  Once in Safe Mode, double-click on SmitfraudFix.exe.
  
  Press 2 and press Enter to delete infected files.
  
  You will be prompted: Registry cleaning - Do you want to clean the registry ?; press Y and press Enter in order to start cleaning the cleaning process. Your desktop will be gone for a while cleaning.
  
  The tool will now check if wininet.dll is infected. You will be prompted to replace the infected file (if found); press Y and press Enter.
  
  The tool will restart your computer to finish the cleaning process; if it doesn't, please restart manually into Normal Mode.
  
  A text file will appear onscreen, with results from the cleaning process; please copy and paste the contents of that report into your next reply. The report can also be found at the root of the system drive, usually at C: apport.txt
  
  Note to users: Running option 2 on a clean machine will remove your desktop background.

  ---

  1. Please download and install CCleaner Slim.
  2. Once installed, double click on the desktop shortcut created.
  3. On the leftmost column, click on Tools.
  4. On the middle column, click on Uninstall.
  5. At the bottom right hand corner, click on the Save to text file... button.
  6. By default, it saves this file to C:\Program Files\CCleaner named install.txt. You may want to save it to your desktop to find it easily. Click Save.
  7. Close CCleaner.

  Post back:

  1. Smitfraudfix report

  2. A new HijackThis log

  3. Virus Total or Jotti scan results of the file

  4. CCleaner install.txt file

• 0petslave0

  14 Feb 08, 17:29

   

   

   

   

   

   

   

   

  1) SmitFraudFix v2.288
  
  Scan done at 17:11:37.53, Thu 02/14/2008
  Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
  OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
  The filesystem type is NTFS
  Fix run in safe mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{917f93bf-6714-4e11-8982-59db2e0f88fc}"="epistylar"
  
  [HKEY_CLASSES_ROOT\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}\InProcServer32]
  @="C:\WINDOWS\system32\eeioq.dll"
  
  [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}\InProcServer32]
  @="C:\WINDOWS\system32\eeioq.dll"
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Killing process
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» hosts
  
  
  127.0.0.1 localhost
  
  »»»»»»»»»»»»»»»»»»»»»»»» VACFix
  
  VACFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
  
  S!Ri's WS2Fix: LSP not Found.
  »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
  
  GenericRenosFix by S!Ri
  
  C:\WINDOWS\system32\eeioq.dll -> Hoax.Win32.Renos.gen.o
  C:\WINDOWS\system32\eeioq.dll -> Deleted
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
  
  C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareCrush 3.7.lnk Deleted
  C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 3.9.lnk Deleted
  C:\DOCUME~1\ADMINI~1\STARTM~1\MalwareCrush 3.7.lnk Deleted
  C:\DOCUME~1\ADMINI~1\STARTM~1\VirusHeat 3.9.lnk Deleted
  C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\MalwareCrush Deleted
  C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\VirusHeat 3.9 Deleted
  C:\DOCUME~1\ADMINI~1\Desktop\MalwareCrush.lnk Deleted
  C:\DOCUME~1\ADMINI~1\Desktop\VirusHeat 3.9.lnk Deleted
  C:\Program Files\Helper\ Deleted
  C:\Program Files\MalwareCrush\ Deleted
  C:\Program Files\NetProject\ Deleted
  C:\Program Files\Sotfone\ Deleted
  C:\Program Files\VirusHeat 3.9\ Deleted
  
  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
  
  IEDFix
  Credits: Malware Analysis & Diagnostic
  Code: S!Ri
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{53231809-B3C6-4430-BD3D-20774D0A0D81}: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS1\Services\Tcpip\..\{53231809-B3C6-4430-BD3D-20774D0A0D81}: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS2\Services\Tcpip\..\{53231809-B3C6-4430-BD3D-20774D0A0D81}: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=218.186.1.88 202.156.1.68 202.156.1.48
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
  !!!Attention, following keys are not inevitably infected!!!
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "System"=""
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
  Registry Cleaning done.
  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» End
  
  
  2) Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 5:20:49 PM, on 2/14/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\DigitalPersona\Bin\DpHost.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32 vsvc32.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32 undll32.exe
  C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
  C:\Program Files\Microsoft IntelliType Pro\type32.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Microsoft IntelliPoint\point32.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
  C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
  C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
  O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
  O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar esources\en-US\local\search.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin pjpi160_03.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin pjpi160_03.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
  O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
  O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32 vsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  --
  End of file - 8566 bytes
  
  3) i sitll can't able to upload it. i tried searching it on my own but i'm not able to find this file.

   

   4)6200
  6200_Help
  6200Trb
  Adobe Flash Player ActiveX
  Adobe Flash Player Plugin
  Adobe Help Center 2.1
  Adobe Photoshop Elements 5.0
  Adobe Reader 8.1.2
  AiO_Scan
  AiOSoftware
  Apple Mobile Device Support
  Apple Software Update
  Audition
  avast! Antivirus
  BitComet 0.97
  BufferChm
  CCleaner (remove only)
  Chinese Simplified Fonts Support For Adobe Reader 8
  Command & Conquer Generals
  Counter-Strike: Condition Zero
  Destinations
  DigitalPersona Password Manager 1.0.0
  Director
  DivX Player
  EasyCleaner
  Fax
  GunboundWC
  HijackThis 2.0.2
  Hotfix for Windows XP (KB914440)
  HP Image Zone 4.7
  HP Photosmart Essential
  HP Product Assistant
  HP PSC & OfficeJet 4.7
  HP Software Update
  HPSystemDiagnostics
  Intel Application Accelerator
  Internet Service
  iTunes
  Java 2 Runtime Environment, SE v1.4.2_05
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Java(TM) SE Runtime Environment 6 Update 1
  K-Lite Codec Pack 3.3.0 Full
  Linksys Wireless-G USB Network Adapter
  MalwareCrush 3.7
  Microsoft IntelliPoint 5.2
  Microsoft IntelliType Pro 5.2
  Microsoft Office Professional Edition 2003
  Microsoft Visual C++ 2005 Redistributable
  MSN
  MSXML 4.0 SP2 (KB927978)
  MSXML 4.0 SP2 (KB936181)
  MultiMedia Software
  Nokia Connectivity Cable Driver
  Nokia MTP driver
  Nokia Nseries Skin for Microsoft Windows Media Player
  Nokia PC Connectivity Solution
  Nokia PC Suite
  Nokia themes for your device
  NVIDIA Drivers
  O2Jam (e-Games) v.3.50
  Opera 9.20
  Pinnacle PCTV
  ProductContext
  QFolder
  QuickTime
  Rakion International
  Readme
  RealPlayer
  Realtek RTL8139/810x Fast Ethernet NIC Driver Setup
  Rhapsody Player Engine
  Safari
  Scan
  ScannerCopy
  Security Update for Windows Internet Explorer 7 (KB938127)
  Security Update for Windows Internet Explorer 7 (KB939653)
  Security Update for Windows Internet Explorer 7 (KB942615)
  Security Update for Windows Internet Explorer 7 (KB944533)
  Security Update for Windows Media Player (KB911564)
  Security Update for Windows Media Player 10 (KB917734)
  Security Update for Windows Media Player 10 (KB936782)
  Security Update for Windows Media Player 6.4 (KB925398)
  Security Update for Windows XP (KB890046)
  Security Update for Windows XP (KB893756)
  Security Update for Windows XP (KB896358)
  Security Update for Windows XP (KB896423)
  Security Update for Windows XP (KB896428)
  Security Update for Windows XP (KB899587)
  Security Update for Windows XP (KB899591)
  Security Update for Windows XP (KB901017)
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB901214)
  Security Update for Windows XP (KB902400)
  Security Update for Windows XP (KB904706)
  Security Update for Windows XP (KB905414)
  Security Update for Windows XP (KB905749)
  Security Update for Windows XP (KB908519)
  Security Update for Windows XP (KB911562)
  Security Update for Windows XP (KB911927)
  Security Update for Windows XP (KB913580)
  Security Update for Windows XP (KB914388)
  Security Update for Windows XP (KB914389)
  Security Update for Windows XP (KB917422)
  Security Update for Windows XP (KB917953)
  Security Update for Windows XP (KB918118)
  Security Update for Windows XP (KB918439)
  Security Update for Windows XP (KB919007)
  Security Update for Windows XP (KB920213)
  Security Update for Windows XP (KB920670)
  Security Update for Windows XP (KB920683)
  Security Update for Windows XP (KB920685)
  Security Update for Windows XP (KB921503)
  Security Update for Windows XP (KB922819)
  Security Update for Windows XP (KB923191)
  Security Update for Windows XP (KB923414)
  Security Update for Windows XP (KB923689)
  Security Update for Windows XP (KB923694)
  Security Update for Windows XP (KB923789)
  Security Update for Windows XP (KB923980)
  Security Update for Windows XP (KB924191)
  Security Update for Windows XP (KB924270)
  Security Update for Windows XP (KB924667)
  Security Update for Windows XP (KB925902)
  Security Update for Windows XP (KB926255)
  Security Update for Windows XP (KB926436)
  Security Update for Windows XP (KB927779)
  Security Update for Windows XP (KB927802)
  Security Update for Windows XP (KB928255)
  Security Update for Windows XP (KB928843)
  Security Update for Windows XP (KB929123)
  Security Update for Windows XP (KB930178)
  Security Update for Windows XP (KB931261)
  Security Update for Windows XP (KB931784)
  Security Update for Windows XP (KB932168)
  Security Update for Windows XP (KB933729)
  Security Update for Windows XP (KB935839)
  Security Update for Windows XP (KB935840)
  Security Update for Windows XP (KB936021)
  Security Update for Windows XP (KB937894)
  Security Update for Windows XP (KB938829)
  Security Update for Windows XP (KB941202)
  Security Update for Windows XP (KB941568)
  Security Update for Windows XP (KB941569)
  Security Update for Windows XP (KB941644)
  Security Update for Windows XP (KB943055)
  Security Update for Windows XP (KB943460)
  Security Update for Windows XP (KB943485)
  Security Update for Windows XP (KB944653)
  Security Update for Windows XP (KB946026)
  SoundMAX
  Spybot - Search & Destroy 1.4
  Sunbelt CounterSpy
  TrayApp
  Unload
  Update for Windows XP (KB894391)
  Update for Windows XP (KB898461)
  Update for Windows XP (KB900485)
  Update for Windows XP (KB904942)
  Update for Windows XP (KB908531)
  Update for Windows XP (KB910437)
  Update for Windows XP (KB911280)
  Update for Windows XP (KB916595)
  Update for Windows XP (KB920872)
  Update for Windows XP (KB922582)
  Update for Windows XP (KB927891)
  Update for Windows XP (KB930916)
  Update for Windows XP (KB931836)
  Update for Windows XP (KB933360)
  Update for Windows XP (KB936357)
  Update for Windows XP (KB938828)
  Update for Windows XP (KB942763)
  VirusHeat 3.9
  WebFldrs XP
  WebReg
  Winamp
  Winamp Toolbar
  Windows Driver Package - Nokia Modem (06/12/2006 6.81.0.21)
  Windows Driver Package - Pinnacle Systems (3xHybrid) MEDIA 08/30/2004 1.3.1.15
  Windows Installer 3.1 (KB893803)
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Media Format Runtime
  Windows Media Player 10
  Windows Safety Alert
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB887742
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB893066
  Windows XP Hotfix - KB893086
  WinPatrol 2007
  WinRAR archiver
  WinZip
  Yahoo! Internet Mail
  Yahoo! Search Protection
  Yahoo! Toolbar
  
  

• ndmmxiaomayi

  14 Feb 08, 20:20

  Uninstall VirusHeat 3.9. It's a fake antispyware.

  Can you upload your HijackThis log to Mediafire

  That makes it easier for me to figure out the log.

  Thanks. Then post back the download link.

• 0petslave0

  15 Feb 08, 07:19

  http://www.mediafire.com/?9xdxq4z1ybw

• ndmmxiaomayi

  15 Feb 08, 13:16

  New log looks better.

  Please download Ewido Micro Scanner and save it to your desktop.
  
  Double click to run it. It will start downloading the signatures. If your firewall prompts, please allow it.
  
  Once the signatures are downloaded, click on Start Scan.
  
  Once done, click on Save Report. Save it to your desktop.
  
  Please post back this log in your next reply.

• 0petslave0

  16 Feb 08, 06:26

  __________________________________________________
  ewido anti-spyware online scanner
  http://www.ewido.net
  __________________________________________________
  
  
  Name: TrackingCookie.Atdmt
  Path: C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
  Risk: Medium
  
  Name: TrackingCookie.Adbrite
  Path: :mozilla.6:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\fjy3eqf6.default\cookies.txt
  Risk: Medium
  
  Name: TrackingCookie.Adbrite
  Path: :mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\fjy3eqf6.default\cookies.txt
  Risk: Medium
  
  Name: Downloader.Agent.hat
  Path: C:\System Volume Information\_restore{DB9ADF6C-5B05-4314-9696-431B956F743B}\RP254\A0132624.exe
  Risk: High
  

• ndmmxiaomayi

  16 Feb 08, 12:39

  Update Java Runtime Environment

  First, uninstall these old versions of Java Runtime Environment:

  Java 2 Runtime Environment, SE v1.4.2_05
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Java(TM) SE Runtime Environment 6 Update 1

  Download the latest version here - http://java.sun.com/javase/downloads/index.jsp

  Scroll down and find Java Runtime Environment (JRE) 6 Update 4, then click on Download.

  Install a firewall

  Online Armour Free

  Sunbelt Kerio

  After installing the firewall and JRE updates, restart your computer.

  Post back a new HijackThis log. Upload to the Mediafire link.

• 0petslave0

  17 Feb 08, 17:43

  http://www.mediafire.com/?8jmzwyjygzm

• ndmmxiaomayi

  18 Feb 08, 20:24

  Any other issues?