The_Void
Topic Starter
Hello. I think my computer got infected with some viruses from some other computers which are connected to the same router as me. Since then I've deleted the sharing folders service (I used to have many shared folders on my computer) using Network Connections under Control Panel.
I then performed a full scan using Malwarebytes AntiMalware, which did not detect any findings.
I scanned all my harddisks, and skipped my dvd/cd drives (including those mounted by daemon tools). I also included Y drive in the scan, but I have no idea where this drive came from as it isn't listed under My Computer and I've never seen it or created it before.
The log is below:
After restarting my computer, I then did a complete system scan using Avira the next day. There were 3 detections. I deleted all detections reported by Avira.
The log is below:
Then the next day (after I restarted my computer again after the previous antivirus scan), I ran HijackThis.
The log is below:
The screenshot is below:
[external image: Posted Image]
Also a while after the HijackThis scan was over (I don't know exactly how long after), a dialog box from windows popped up.
The screenshot is below:
[external image: Posted Image]
I clicked Cancel for this.
Please help me out. Any help would be much appreciated.
Edit: the topic title seems to have been cut-off. It should say "AntiVir keeps complaining that certain viruses keep re-appearing, located in system folders in C drive"
I then performed a full scan using Malwarebytes AntiMalware, which did not detect any findings.
I scanned all my harddisks, and skipped my dvd/cd drives (including those mounted by daemon tools). I also included Y drive in the scan, but I have no idea where this drive came from as it isn't listed under My Computer and I've never seen it or created it before.
The log is below:
Malwarebytes' Anti-Malware 1.34 Database version: 1777 Windows 5.1.2600 Service Pack 1 2/19/2009 3:17:25 PM mbam-log-2009-02-19 (15-17-25).txt Scan type: Full Scan (C:\|D:\|G:\|H:\|J:\|K:\|L:\|Y:\|) Objects scanned: 962827 Time elapsed: 7 hour(s), 28 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
After restarting my computer, I then did a complete system scan using Avira the next day. There were 3 detections. I deleted all detections reported by Avira.
The log is below:
Avira AntiVir Personal
Report file date: Friday, February 20, 2009 05:19
Scanning for 1256036 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 1) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: PATRICKSNEWCOMP
Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 11/18/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 11/27/2008 09:08:24
AVSCAN.DLL : 8.1.4.0 40705 Bytes 7/18/2008 07:39:13
LUKE.DLL : 8.1.4.5 164097 Bytes 7/18/2008 07:39:14
LUKERES.DLL : 8.1.4.0 12033 Bytes 7/18/2008 07:39:14
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 11:30:08
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2/11/2009 15:57:00
ANTIVIR2.VDF : 7.1.2.13 2048 Bytes 2/11/2009 15:57:02
ANTIVIR3.VDF : 7.1.2.48 213504 Bytes 2/19/2009 16:14:42
Engineversion : 8.2.0.85
AEVDF.DLL : 8.1.1.0 106868 Bytes 1/31/2009 18:29:52
AESCRIPT.DLL : 8.1.1.47 348539 Bytes 2/13/2009 15:57:45
AESCN.DLL : 8.1.1.7 127347 Bytes 2/13/2009 15:57:36
AERDL.DLL : 8.1.1.3 438645 Bytes 11/6/2008 16:58:05
AEPACK.DLL : 8.1.3.8 397684 Bytes 2/6/2009 13:25:34
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 12/12/2008 09:02:00
AEHEUR.DLL : 8.1.0.95 1606007 Bytes 2/19/2009 16:14:51
AEHELP.DLL : 8.1.2.0 119159 Bytes 11/19/2008 19:20:42
AEGEN.DLL : 8.1.1.19 332148 Bytes 2/19/2009 16:14:43
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/16/2008 10:21:10
AECORE.DLL : 8.1.6.6 176501 Bytes 2/18/2009 16:15:06
AEBB.DLL : 8.1.0.3 53618 Bytes 10/16/2008 10:21:06
AVWINLL.DLL : 1.0.0.12 15105 Bytes 7/18/2008 07:39:13
AVPREF.DLL : 8.0.2.0 38657 Bytes 7/18/2008 07:39:13
AVREP.DLL : 8.0.0.2 98344 Bytes 8/1/2008 02:47:11
AVREG.DLL : 8.0.0.1 33537 Bytes 7/18/2008 07:39:13
AVARKT.DLL : 1.0.0.23 307457 Bytes 4/18/2008 14:16:38
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 7/18/2008 07:39:13
SQLITE3.DLL : 3.3.17.1 339968 Bytes 4/18/2008 14:16:39
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 7/18/2008 07:39:14
NETNT.DLL : 8.0.0.1 7937 Bytes 4/18/2008 14:16:39
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 7/18/2008 07:39:10
RCTEXT.DLL : 8.0.52.0 86273 Bytes 7/18/2008 07:39:10
Configuration settings for the scan:
Jobname……………………..: Complete system scan
Configuration file……………: c:\program files\antivir personaledition classic\sysscan.avp
Logging……………………..: low
Primary action……………….: interactive
Secondary action……………..: ignore
Scan master boot sector……….: on
Scan boot sector……………..: on
Boot sectors…………………: C:, D:, G:, H:, J:, K:, L:,
Process scan…………………: on
Scan registry………………..: on
Search for rootkits…………..: off
Scan all files……………….: Intelligent file selection
Scan archives………………..: on
Recursion depth………………: 20
Smart extensions……………..: on
Macro heuristic………………: on
File heuristic……………….: medium
Start of the scan: Friday, February 20, 2009 05:19
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'AutoHotkey.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'StealthBot v2.6R3.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'winamp.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'sndvol32.exe' - '1' Module(s) have been scanned
Scan process 'mspaint.exe' - '1' Module(s) have been scanned
Scan process 'taskmgr.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'G:\'
[INFO] No virus was found!
Boot sector 'H:\'
[INFO] No virus was found!
Boot sector 'J:\'
[INFO] No virus was found!
Boot sector 'K:\'
[INFO] No virus was found!
Boot sector 'L:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '49' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{110607E9-2B5C-45EC-AC01-680A48BDE1ED}\RP2\A0034242.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/IRCBot.578560K back-door program
[NOTE] The file was deleted!
C:\System Volume Information\_restore{110607E9-2B5C-45EC-AC01-680A48BDE1ED}\RP2\A0034243.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/IRCBot.578560K back-door program
[NOTE] The file was deleted!
C:\System Volume Information\_restore{110607E9-2B5C-45EC-AC01-680A48BDE1ED}\RP4\A0035744.exe
[DETECTION] Is the TR/Runner.E Trojan
[NOTE] The file was deleted!
C:\WINDOWS\system32\drivers\dtscsi.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part02.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x03 - Ultra Sonic.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part03.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x05 - Super Sonic.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part04.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x06 - Sonic Racer.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part05.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x08 - Hooked On Sonics.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part06.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x09 - Sonics Nightmare.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part07.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x10 - Warp Sonic.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part08.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x12 Sonic Past Cool.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part09.rar
[0] Archive type: RAR
–> Sonic SatAM - 1x13 - Heads or Tails.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part10.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x02 - Sonic Conversion.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part11.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x03 - Blast To The Past pt.1.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part12.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x05 - No Brainer.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part13.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x06 - Fed Up With Antoine - Ghost Busted.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part14.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x08 - The Void.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part15.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x09 - The Odd Couple & Ro-Becca.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part16.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x11 - Drood Henge.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\New Folder\Sonic the Hedgehog SatAM Collection\Sonic the Hedgehog SatAM Collection.part17.rar
[0] Archive type: RAR
–> Sonic SatAM - 2x12 - Spyhog.wmv
[WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'G:\'
Begin scan in 'H:\'
H:\nsf_tosec.ace
[0] Archive type: ACE
–> Music - Nintendo NES - NSF (tosec 0.10) (0 missing)\Daimashikyou Galious (1987)(Otoshi Hidenori, Shinkon Shinya, Damian Fujio, Kyouhei Sada & Onigiri Yamako - Konami)(76 Songs)[With SFX].nsf
[WARNING] The file could not be opened!
–> Music - Nintendo NES - NSF (tosec 0.10) (0 missing)\Daisenryaku (1988)(Bothtec)(3 Songs).nsf
[WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'J:\'
Begin scan in 'K:\'
K:\Icewind Dale - The Ultimate Collection 0\Addings & Patches.r00
[0] Archive type: RAR
–> Addings & Patches\Unofficial\IWD1-HoW-NoCD v1.41 [041115]\IDHoWv1.4(041115).exe
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD1\iwd-tuc-cd1.r30
[0] Archive type: RAR
–> iwd-tuc-cd1.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD2\iwd-tuc-cd2.r30
[0] Archive type: RAR
–> iwd-tuc-cd2.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD3\iwd-tuc-cd3.r30
[0] Archive type: RAR
–> iwd-tuc-cd3.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD4\iwd-tuc-cd4.r03
[0] Archive type: RAR
–> iwd-tuc-cd4.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD5\iwd-tuc-cd5.r17
[0] Archive type: RAR
–> iwd-tuc-cd5.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD6\iwd-tuc-cd6.r34
[0] Archive type: RAR
–> iwd-tuc-cd6.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD7\iwd-tuc-cd7.r34
[0] Archive type: RAR
–> iwd-tuc-cd7.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\CD8\iwd-tuc-cd8.r00
[0] Archive type: RAR
–> iwd-tuc-cd8.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Icewind Dale - The Ultimate Collection 0\Extra [TeamRPG addition]\iwd-tuc-cd9.r04
[0] Archive type: RAR
–> iwd-tuc-cd9.sub
[WARNING] No further files can be extracted from this archive. The archive will be closed
K:\Xenogears [PSX] [NTSC-US]\Xenogears_NTSC_CD_1.rar
[WARNING] An exception has been identified!
[WARNING] In the module 'aecore.dll' an exception occured.
Calling the function AVEPROC_TestFile in file: \\?\K:\Xenogears [PSX] [NTSC-US]\Xenogears_NTSC_CD_1.rar
Error description:ACCESS_VIOLATION
EAX = 0AE12148 EBX = 02430AA8
ECX = 0AE12124 EDX = 0000022E
ESI = 09C64EC4 EDI = 02430aa4
EIP = 012C1523 EBP = 0A45007C
ESP = 01A2F2F4 Flg = 00010287
CS = 00000023 SS = 0000001B
Begin scan in 'L:\'
End of the scan: Friday, February 20, 2009 12:52
Used time: 7:33:11 Hour(s)
The scan has been done completely.
54147 Scanning directories
2039114 Files were scanned
3 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
3 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
2039108 Files not concerned
15576 Archives were scanned
32 Warnings
3 Notes
Then the next day (after I restarted my computer again after the previous antivirus scan), I ran HijackThis.
The log is below:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:14:06 AM, on 2/21/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\System32\SNDVOL32.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
K:\sb stuff\StealthBot v2.6R3.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Laptop C drive (Sun 14 May 2006 to Thu 18 May 2006)\Winamp\winamp.exe
C:\Program Files\AutoHotkey\AutoHotkey.exe
K:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\AntiVir PersonalEdition Classic\GUARDGUI.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://about:blank
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\LocalService\fxwroll.exe \s
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O12 - Plugin for .m4v: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://spring1.ura.gov.sg/mapguide6/mgaxctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1234973837453
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: FarStone File Event Manager (efbfsB) - FarStone Technology, Inc. - K:\Program Files\FarStone\DriveClone\EFB\efbfsB.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: WMI System App (WMISYS) - Unknown owner - C:\WINDOWS\system\wmisys.exe
–
End of file - 5877 bytes
While the HijackThis scan was being run, there was 1 popup from Avira which was a detection of a previously detected virus. The screenshot is below:
[external image: Posted Image]
Also a while after the HijackThis scan was over (I don't know exactly how long after), a dialog box from windows popped up.
The screenshot is below:
[external image: Posted Image]
I clicked Cancel for this.
Please help me out. Any help would be much appreciated.
Edit: the topic title seems to have been cut-off. It should say "AntiVir keeps complaining that certain viruses keep re-appearing, located in system folders in C drive"
