What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijackthis Log File

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi. Here is my log file. This is the first time I've done it. Just trying to find out if I have any spyware, trojans, viruses, etc., because my laptop is running kind of slow lately.
Thanks a lot for your help.


Logfile of HijackThis v1.99.1
Scan saved at 11:37:22 AM, on 11/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Billionton\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Canon\MultiPASS\mpservic.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\INSTAL\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
C:\PROGRA~1\MICROS~4\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Billionton\Bluetooth Software\BTTray.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\INSTAL\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://client.jogo.cn/cdn/browser/sidesear…esearch-en.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://client.jogo.cn/cdn/browser/customse…msearch-en.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R3 - URLSearchHook: SrchHook Class - {EED92A43-CFCE-4548-BD73-B0A405470ED5} - C:\PROGRA~1\CNNIC\Cdn\iesrch.dll (file missing)
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.msn.com/"); (C:\Documents and Settings\Ilya\Application Data\Mozilla\Profiles\default\y1iyih5l.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Ilya\Application Data\Mozilla\Profiles\default\y1iyih5l.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\INSTAL\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Billionton\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ¿á±ê - {1D901067-2529-4A9B-9B6B-7A1DB3A44CB5} - C:\Program Files\coolsign\coolsign.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {A78856A6-334B-43AF-96F5-58574005910D} (CEinstaller Object) - https://secure200.ipixmedia.com/code/Einstaller.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BAB2DB5-2A96-4070-957B-4B0CD8E47D40}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Billionton\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Routing Protect Access (MOBILL) - Unknown owner - C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE (file missing)
O23 - Service: MPService - Canon Information Systems - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: Registry Protector (WalALET) - Unknown owner - C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE (file missing)
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #2 last edited
Hello ilyukha13 and Welcome to TomCoyote,

Use a Firewall – I do not see a firewall application installed. You should not rely only on the Windows XP firewall. Please install a firewall application. For a tutorial on Firewalls and a listing of some available ones see the link below:
Understanding and Using Firewalls

Download this file – combofix.exe
and save it to your desktop but DO NOT RUN IT YET.
Also save the below command in Notepad as a text file so that you can copy/paste in safe mode.

Please download this file
http://www.kztechs.com/sreng/sreng2.zip DO NOT RUN IT YET.

Please download this file
http://www.gmer.net/gmer.zip DO NOT RUN IT YET.

Please set your system to show all files; please see here if you're unsure how to do this.
===================
Scan with HijackThis. Place a check against each of the following:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://client.jogo.cn/cdn/browser/sidesear…esearch-en.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://client.jogo.cn/cdn/browser/customse…msearch-en.html
R3 - URLSearchHook: SrchHook Class - {EED92A43-CFCE-4548-BD73-B0A405470ED5} - C:\PROGRA~1\CNNIC\Cdn\iesrch.dll (file missing)
O9 - Extra button: ¿á±ê - {1D901067-2529-4A9B-9B6B-7A1DB3A44CB5} - C:\Program Files\coolsign\coolsign.dll
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\Program Files\coolsign\coolsign.dll<=file
Exit Explorer, and reboot as normal afterwards.

STEP 1.
======
ComboFix-wow

"%userprofile%\desktop\combofix.exe" /wow

Boot into safe mode by tapping the F8 key just before Windows starts to load.

go to start –> run and copy/paste in the following:

"%userprofile%\desktop\combofix.exe" /wow

When finished, it shall produce a log for you. Save it and post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

STEP 2.
======
SREng
Extract it to Desktop and double click SREng.exe to run it
Select: Smart Scan and click on the [Scan] button

When finished, click on the Save Reports button and save the log to Desktop

Please post the SREng log in your next reply.

STEP 3.
======
GMER
  • Disconnect from internet and close running programs.
  • There is a small chance this app may crash your computer so save any work you have open.
  • Double click gmer.exe
In your next post, please include
  • new hijackthis log
  • combofix log
  • the SREng log
  • the gmer log
*use separate posts to ensure the logs don't get cut off!
Post #3
Thanks for your response. Here is the new hijack log

Logfile of HijackThis v1.99.1
Scan saved at 5:25:16 PM, on 11/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Billionton\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Canon\MultiPASS\mpservic.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\INSTAL\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
C:\PROGRA~1\MICROS~4\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Billionton\Bluetooth Software\BTTray.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\INSTAL\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.msn.com/"); (C:\Documents and Settings\Ilya\Application Data\Mozilla\Profiles\default\y1iyih5l.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Ilya\Application Data\Mozilla\Profiles\default\y1iyih5l.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [.nvsvc] ;
O4 - HKLM\..\Run: [ICQ Lite] ; C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [MimBoot] ; C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [mmtask] ;
O4 - HKLM\..\Run: [MPTBox] ; "C:\Program Files\Canon\MultiPASS\MPTBox.exe"
O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] ; C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [rundll32] ; C:\Program Files\Common Files\rundll32.exe
O4 - HKLM\..\Run: [SDTaskbar] ;
O4 - HKLM\..\Run: [SunJavaUpdateSched] ; C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [System] ;
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UpdateManager] ;
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\INSTAL\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI DeviceDetect] ; C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Launchpad] ; "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [MoneyAgent] ;
O4 - HKCU\..\Run: [Sonic RecordNow!] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Billionton\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Billionton\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {A78856A6-334B-43AF-96F5-58574005910D} (CEinstaller Object) - https://secure200.ipixmedia.com/code/Einstaller.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BAB2DB5-2A96-4070-957B-4B0CD8E47D40}: NameServer = 192.168.1.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Billionton\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MPService - Canon Information Systems - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: Registry Protector (WalALET) - Unknown owner - C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE (file missing)
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #4
Here is a Combofix log

Ilya - 06-11-04 14:26:39.01 Service Pack 2
ComboFix 06.11.3W - Running from: "C:\Documents and Settings\Ilya\desktop"
Command switches used :: /wow

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\All Users\Templates\temp.exe
C:\WINDOWS\csrss.exe
C:\WINDOWS\system32\iexp_log.txt
C:\WINDOWS\system32\Score.txt
C:\WINDOWS\system32\jjyqou47.dll
C:\WINDOWS\system32\zkmlfr49.dll
C:\WINDOWS\system32\ztqxif27.dll
C:\WINDOWS\system32\wbem\awniph60.dll
C:\WINDOWS\system32\wbem\dforcr85.dll
C:\WINDOWS\system32\wbem\tsdccl97.dll
C:\WINDOWS\system32\drivers\paraudio.sys
C:\WINDOWS\system32\advport.dll
C:\WINDOWS\system32\wbem\ocmor.dll
C:\Program Files\coolsign


((((((((((((((((((((((((((((((( Files Created from 2006-10-04 to 2006-11-04 ))))))))))))))))))))))))))))))))))


2006-11-02 13:08 d——– C:\Documents and Settings\Ilya\Application Data\ppStream
2006-11-02 13:07 d——– C:\Program Files\21cn
2006-11-02 11:57 d——– C:\Program Files\Lavasoft
2006-11-01 21:05 d——– C:\WINDOWS\PLive3U
2006-11-01 12:39 163,444 –a—— C:\WINDOWS\~tmp3667.exe
2006-10-31 14:34 163,444 –a—— C:\WINDOWS\~tmp5090.exe
2006-10-31 12:59 163,444 –a—— C:\WINDOWS\~tmp3845.exe
2006-10-31 12:53 163,444 –a—— C:\WINDOWS\~tmp1909.exe
2006-10-31 00:05 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2006-10-31 00:04 569,344 –a—— C:\WINDOWS\SYSTEM32\ExButton.dll
2006-10-31 00:04 491,520 –a—— C:\WINDOWS\SYSTEM32\ExMenu.dll
2006-10-31 00:04 479,232 –a—— C:\WINDOWS\SYSTEM32\ExTab.dll
2006-10-31 00:04 356,352 –a—— C:\WINDOWS\SYSTEM32\eSellerateEngine.dll
2006-10-31 00:04 245,760 –a—— C:\WINDOWS\SYSTEM32\ExPMenu.dll
2006-10-31 00:04 118,784 –a—— C:\WINDOWS\SYSTEM32\eWebControl.dll
2006-10-31 00:04 d——– C:\Program Files\Common Files\eSellerate
2006-10-31 00:04 d——– C:\Program Files\AnswersThatWork
2006-10-30 19:41 173,056 –a—— C:\WINDOWS\~tmp1855.exe
2006-10-28 09:44 173,056 –a—— C:\WINDOWS\~tmp8322.exe
2006-10-28 09:40 173,056 –a—— C:\WINDOWS\~tmp1507.exe
2006-10-28 09:29 d——– C:\Program Files\tvants
2006-10-22 16:31 d——– C:\Documents and Settings\Ilya\Application Data\vlc
2006-10-21 15:57 d——– C:\Program Files\TVUPlayer
2006-10-21 14:55 d——– C:\Documents and Settings\Ilya\Application Data\PPLive
2006-10-21 14:54 d——– C:\Program Files\Common Files\Synacast
2006-10-16 13:27 d——– C:\Documents and Settings\All Users\Application Data\Adobe
2006-10-16 11:39 65,536 –a—— C:\WINDOWS\SYSTEM32\PUUninst.exe
2006-10-16 11:39 d——– C:\WINDOWS\SYSTEM32\AdMission
2006-10-14 14:57 d——– C:\Program Files\Juno
2006-10-10 11:27 679,936 –a—— C:\WINDOWS\SYSTEM32\xvidcore.dll
2006-10-10 11:27 626,688 –a—— C:\WINDOWS\SYSTEM32\vp7vfw.dll
2006-10-10 11:27 446,464 –a—— C:\WINDOWS\SYSTEM32\vp31vfw.dll
2006-10-10 11:27 438,272 –a—— C:\WINDOWS\SYSTEM32\vp6vfw.dll
2006-10-10 11:27 421,888 –a—— C:\WINDOWS\SYSTEM32\OpenQuicktimeLib.dll
2006-10-10 11:27 413,760 –a—— C:\WINDOWS\SYSTEM32\mpg4c32.dll
2006-10-10 11:27 286,720 –a—— C:\WINDOWS\SYSTEM32\3ivxVfWCodec.dll
2006-10-10 11:27 19,968 –a—— C:\WINDOWS\SYSTEM32\cpuinf32.dll
2006-10-10 11:27 157,696 –a—— C:\WINDOWS\SYSTEM32\unrar.dll
2006-10-10 11:27 155,648 –a—— C:\WINDOWS\SYSTEM32\xvidvfw.dll
2006-10-10 11:27 1,415,680 –a—— C:\WINDOWS\SYSTEM32\WMV9VCM.dll
2006-10-10 11:27 1,024,000 –a—— C:\WINDOWS\SYSTEM32\3ivx.dll
2006-10-10 11:27 d——– C:\Program Files\K-Lite Codec Pack
2006-10-10 01:20 d——– C:\Documents and Settings\Ilya\Application Data\DivX
2006-10-08 18:53 1,047,552 –a—— C:\WINDOWS\SYSTEM32\mfc71u.dll
2006-10-08 15:44 d——– C:\Program Files\eMule
2006-10-07 11:55 d——– C:\Downloads
2006-10-07 11:53 d——– C:\Program Files\BitComet
2006-10-07 00:48 dr-h—– C:\$VAULT$.AVG
2006-10-07 00:44 d——– C:\Program Files\RDcalc
2006-10-06 23:50 776,096 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avg7core.sys
2006-10-06 23:50 4,992 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avgtdi.sys
2006-10-06 23:50 4,288 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avg7rsw.sys
2006-10-06 23:50 27,776 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avg7rsxp.sys
2006-10-06 23:50 23,424 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\avgmfrs.sys
2006-10-06 23:50 d——– C:\Program Files\Grisoft
2006-10-06 23:50 d——– C:\Documents and Settings\Ilya\Application Data\AVG7
2006-10-06 23:50 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2006-10-06 23:50 d——– C:\Documents and Settings\All Users\Application Data\avg7
2006-10-06 23:29 d——– C:\Program Files\IBE


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-04 14:33 ——– d——– C:\Program Files\Common Files
2006-11-02 11:57 ——– d——– C:\Documents and Settings\Ilya\Application Data\Lavasoft
2006-11-01 22:11 359040 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\TCPIP.SYS
2006-11-01 20:53 ——– d——– C:\Program Files\Common Files\System
2006-11-01 12:39 163444 –a—— C:\WINDOWS\~tmp3667.exe
2006-10-31 14:34 163444 –a—— C:\WINDOWS\~tmp5090.exe
2006-10-31 12:59 163444 –a—— C:\WINDOWS\~tmp3845.exe
2006-10-31 12:53 163444 –a—— C:\WINDOWS\~tmp1909.exe
2006-10-31 01:59 ——– d——– C:\Program Files\Ahead
2006-10-30 23:27 ——– d——– C:\Program Files\Common Files\Services
2006-10-30 19:41 173056 –a—— C:\WINDOWS\~tmp1855.exe
2006-10-28 09:44 173056 –a—— C:\WINDOWS\~tmp8322.exe
2006-10-28 09:40 173056 –a—— C:\WINDOWS\~tmp1507.exe
2006-10-21 21:09 ——– d——– C:\Program Files\Microsoft ActiveSync
2006-10-21 20:00 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-21 19:59 ——– d——– C:\Program Files\Adobe
2006-10-21 14:33 ——– d——– C:\Program Files\Windows Media Player
2006-10-21 00:40 ——– d——– C:\Program Files\Windows NT
2006-10-18 10:32 ——– d——– C:\Program Files\Online Services
2006-10-16 13:27 ——– d——– C:\Documents and Settings\Ilya\Application Data\AdobeUM
2006-10-13 15:28 24360 –a—— C:\Documents and Settings\Ilya\Application Data\GDIPFONTCACHEV1.DAT
2006-10-10 01:25 ——– d——– C:\Program Files\Registry Mechanic
2006-10-08 13:20 ——– d——– C:\Program Files\Symantec
2006-10-08 13:20 ——– d——– C:\Program Files\Common Files\Symantec Shared
2006-10-06 21:58 ——– d——– C:\Program Files\Common Files\Microsoft Shared
2006-10-05 16:37 ——– d—s—- C:\Documents and Settings\Ilya\Application Data\Microsoft
2006-10-03 16:32 ——– d——– C:\Program Files\MathType
2006-10-03 16:26 ——– d——– C:\Documents and Settings\Ilya\Application Data\Design Science
2006-09-13 11:14 ——– d——– C:\Documents and Settings\Ilya\Application Data\Real
2006-09-13 11:09 ——– d——– C:\Program Files\Common Files\xing shared
2006-09-13 11:09 ——– d——– C:\Program Files\Common Files\Real
2006-09-08 02:29 585 –a—— C:\WINDOWS\uncspluce.dll
2006-09-05 13:20 ——– d——– C:\Program Files\Canon
2006-08-16 08:33 532480 –a—— C:\WINDOWS\SYSTEM32\manutd_fanzone_players.scr


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"PopUpStopperFreeEdition"="\"C:\\INSTAL\\Panicware\\Pop-Up Stopper Free Edition\\PSFree.exe\""
"H/PC Connection Agent"="\"C:\\PROGRA~1\\MICROS~4\\wcescomm.exe\""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"EPSON Stylus CX4600 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATI9AA.EXE /P26 \"EPSON Stylus CX4600 Series\" /O6 \"USB001\" /M \"Stylus CX4600\""
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\Quickset.exe"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,18,01,00,00,00,00,00,00,60,04,00,00,fc,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
"backup"="C:\\WINDOWS\\pss\\Digital Line Detect.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\DIGITA~1\\DLG.exe "
"item"="Digital Line Detect"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
"backup"="C:\\WINDOWS\\pss\\HOTSYNCSHORTCUTNAME.lnkCommon Startup"
"location"="Common Startup"
"item"="HOTSYNCSHORTCUTNAME"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\MI1933~1\\Office10\\OSA.EXE -b -l"
"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Ilya^Start Menu^Programs^Startup^Epson all-in-one Registration.lnk]
"backup"="C:\\WINDOWS\\pss\\Epson all-in-one Registration.lnkStartup"
"location"="Startup"
"command"=" /remind /language=ENU /PRNM=\"00583\"/PRIN=\"all-in-one\""
"item"="Epson all-in-one Registration"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\.nvsvc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="smss"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI DeviceDetect]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ATIDtct"
"hkey"="HKCU"
"command"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LaunchPd"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\ATI Multimedia\\main\\LaunchPd.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ICQLite"
"hkey"="HKLM"
"command"="C:\\Program Files\\ICQLite\\ICQLite.exe -minimize"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mimboot"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~2\\mimboot.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mmtask"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mnyexpr"
"hkey"="HKCU"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPTBox]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MPTBox"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Canon\\MultiPASS\\MPTBox.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RealPlay"
"hkey"="HKLM"
"command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rundll32]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rundll32"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\rundll32.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTaskbar]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="VS4 Taskbar"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Update"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sgtray"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
Popular
Security



~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20061104-133905-759
O9 - Extra button: ¿á±ê - {1D901067-2529-4A9B-9B6B-7A1DB3A44CB5} - C:\Program Files\coolsign\coolsign.dll
backup-20061104-133905-667
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://client.jogo.cn/cdn/browser/sidesear…esearch-en.html
backup-20061104-133905-584
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://client.jogo.cn/cdn/browser/customse…msearch-en.html
backup-20061104-133905-364
R3 - URLSearchHook: SrchHook Class - {EED92A43-CFCE-4548-BD73-B0A405470ED5} - C:\PROGRA~1\CNNIC\Cdn\iesrch.dll (file missing)
Completion time: 06-11-04 14:33:35.59
C:\ComboFix.txt … 06-11-04 14:33
Post #5
Here is SREng Log 2006-11-04,14:51:52 System Repair Engineer 2.2.6.605 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed Follow item(s) have been choosed: All Boot Items (Including Registry, Startup Folders, Services and so on) Browser Add-ons Runing Processes (Including process model information) File Associations Winsock Provider Autorun.Inf HOSTS File Boot Items Registry [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\INSTAL\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"> [Panicware, Inc.] <"C:\PROGRA~1\MICROS~4\wcescomm.exe"> [Microsoft Corporation] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)SEIKO EPSON CORPORATION] [N/A] [(Verified)Alps Electric Co., Ltd.] [GRISOFT, s.r.o.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Corporation] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91972}> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation] <%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation] <%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Corporation] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation] <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Control Panel\Desktop] [ScreenTime Media] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <.nvsvc><; > [N/A] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\ATI Multimedia\main\ATIDtct.EXE> [ATI Technologies Inc.] <; "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"> [ATI Technologies Inc.] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\ICQLite\ICQLite.exe -minimize> [(Verified)ICQ Ltd.] <; C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe> [Musicmatch, Inc.] <; > [N/A] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; > [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\Canon\MultiPASS\MPTBox.exe"> [Canon Information Systems] <; "C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.] <; C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER> [N/A] <; C:\Program Files\Common Files\rundll32.exe> [N/A] <; > [N/A] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe> [Sun Microsystems, Inc.] <; > [N/A] <; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [N/A] <; > [N/A] ================================== Startup Folders [BTTray] C:\PROGRA~1\BILLIO~1\BLUETO~1\BTTray.exe [WIDCOMM, Inc.]> ================================== Services [Application Management / AppMgmt] %SystemRoot%\System32\appmgmts.dll> [ASP.NET State Service / aspnet_state] [Ati HotKey Poller / Ati HotKey Poller] [AVG7 Alert Manager Server / Avg7Alrt] [AVG7 Update Service / Avg7UpdSvc] [AVG E-mail Scanner / AVGEMS] [Bluetooth Service / btwdins] [Human Interface Device Access / HidServ] %SystemRoot%\System32\hidserv.dll> [InstallDriver Table Manager / IDriverT] <"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"> [Routing Protect Access / MOBILL] <2 - The system cannot find the file specified. > [MPService / MPService] [Portable Equipment Service / Popular] C:\WINDOWS\system32\zkmlfr49.dll> [Indexing Manager / Security] C:\WINDOWS\system32\ztqxif27.dll> [Registry Protector / WalALET] [WLTRYSVC / WLTRYSVC] ================================== Drivers [abp480n5 / abp480n5] <\SystemRoot\system32\DRIVERS\ABP480N5.SYS> [adpu160m / adpu160m] <\SystemRoot\system32\DRIVERS\adpu160m.sys> [Aha154x / Aha154x] <\SystemRoot\system32\DRIVERS\aha154x.sys> [aic78u2 / aic78u2] <\SystemRoot\system32\DRIVERS\aic78u2.sys> [aic78xx / aic78xx] <\SystemRoot\system32\DRIVERS\aic78xx.sys> [AliIde / AliIde] <\SystemRoot\system32\DRIVERS\aliide.sys> [AMD AGP Bus Filter Driver / amdagp] <\SystemRoot\system32\DRIVERS\amdagp.sys> [Alps Touch Pad Filter Driver for Windows 2000/XP / ApfiltrService] [asc / asc] <\SystemRoot\system32\DRIVERS\asc.sys> [asc3350p / asc3350p] <\SystemRoot\system32\DRIVERS\asc3350p.sys> [asc3550 / asc3550] <\SystemRoot\system32\DRIVERS\asc3550.sys> [ATI Remote Wonder II / ATI Remote Wonder II] [ati2mtag / ati2mtag] [ATI USB 2.0 TV Audio Crossbar / atinysxx] [ATI TV WONDER USB2.0 Video & Audio / atinyvxx] [ATI TV WONDER USB2.0 TV Tuner / ATITUNEP2] [ATI TV WONDER USB2.0 Device Driver / ATIUTD] [AVG7 Kernel / Avg7Core] <\SystemRoot\System32\Drivers\avg7core.sys> [AVG7 Wrap Driver / Avg7RsW] <\SystemRoot\System32\Drivers\avg7rsw.sys> [AVG7 Resident Driver XP / Avg7RsXP] <\SystemRoot\System32\Drivers\avg7rsxp.sys> [AVG Network Redirector / AvgTdi] <\SystemRoot\System32\Drivers\avgtdi.sys> [Broadcom 570x Gigabit Integrated Controller / b57w2k] [BASFND / BASFND] <\??\C:\WINDOWS\system32\Drivers\BASFND.sys> [Dell Wireless WLAN Card Driver / BCM43XX] [Bluetooth Audio / BtAudio] [Bluetooth Virtual Communications Driver / BTDriver] [Bluetooth Protocol Stack / BTKRNL] <\SystemRoot\system32\drivers\btkrnl.sys> [Bluetooth BCSP Transport for Pc Card / BTPCCARD] [Bluetooth Serial Driver / BTSERIAL] <\??\C:\WINDOWS\system32\drivers\btserial.sys> [Bluetooth Port Client Driver / BTSLBCSP] <\??\C:\WINDOWS\system32\drivers\btslbcsp.sys> [Bluetooth LAN Access Server / BTWDNDIS] [BVRPMPR5 NDIS Protocol Driver / BVRPMPR5] <\??\D:\INSTAL~E\Core\BVRPMPR5.SYS> [cd20xrnt / cd20xrnt] <\SystemRoot\system32\DRIVERS\cd20xrnt.sys> [cis1284 / cis1284] <\??\C:\WINDOWS\system32\drivers\cis1284.sys> [CmdIde / CmdIde] <\SystemRoot\system32\DRIVERS\cmdide.sys> [dac2w2k / dac2w2k] <\SystemRoot\system32\DRIVERS\dac2w2k.sys> [dpti2o / dpti2o] <\SystemRoot\system32\DRIVERS\dpti2o.sys> [Intel® PRO Adapter Driver / E100B] [HSFHWICH / HSFHWICH] [HSF_DP / HSF_DP] [ini910u / ini910u] <\SystemRoot\system32\DRIVERS\ini910u.sys> [Jukebox / Jukebox] [AEGIS Protocol (IEEE 802.1x) v2.3.1.7 / MDC8021X] [mdmxsdk / mdmxsdk] [mraid35x / mraid35x] <\SystemRoot\system32\DRIVERS\mraid35x.sys> [ATI TV WONDER USB2.0 Specialized MVD Codec / MVDCODEC] [nv / nv] [O2Micro SmartCardBus Reader / O2SCBUS] [OMCI WDM Device Driver / omci] [PalmUSBD / PalmUSBD] [paraudio / paraudio] <2 - The system cannot find the file specified. > [ATI TV WONDER USB2.0 Specialized PCD Codec / PCDCODEC] [Direct Parallel Link Driver / Ptilink] [PxHelp20 / PxHelp20] <\SystemRoot\System32\Drivers\PxHelp20.sys> [ql1080 / ql1080] <\SystemRoot\system32\DRIVERS\ql1080.sys> [Ql10wnt / Ql10wnt] <\SystemRoot\system32\DRIVERS\ql10wnt.sys> [ql12160 / ql12160] <\SystemRoot\system32\DRIVERS\ql12160.sys> [ql1280 / ql1280] <\SystemRoot\system32\DRIVERS\ql1280.sys> [samhid / samhid] [SANDRA / SANDRA] <\??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005\Sandra.sys> [Secdrv / Secdrv] [SIS AGP Bus Filter / sisagp] <\SystemRoot\system32\DRIVERS\sisagp.sys> [Sparrow / Sparrow] <\SystemRoot\system32\DRIVERS\sparrow.sys> [Audio Driver (WDM) - SigmaTel CODEC / STAC97] [symc810 / symc810] <\SystemRoot\system32\DRIVERS\symc810.sys> [symc8xx / symc8xx] <\SystemRoot\system32\DRIVERS\symc8xx.sys> [sym_hi / sym_hi] <\SystemRoot\system32\DRIVERS\sym_hi.sys> [sym_u3 / sym_u3] <\SystemRoot\system32\DRIVERS\sym_u3.sys> [TCP/IP Protocol Driver / Tcpip] [TosIde / TosIde] <\SystemRoot\system32\DRIVERS\toside.sys> [ATI TV WONDER USB2.0 Teletext Decoder / TTDec] [ultra / ultra] <\SystemRoot\system32\DRIVERS\ultra.sys> [ViaIde / ViaIde] <\SystemRoot\system32\DRIVERS\viaide.sys> [WAN Miniport (ATW) / wanatw] [winachsf / winachsf] ================================== Browser Add-ons [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [Java Plug-in] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} [Create Mobile Favorite] {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} [Create Mobile Favorite] {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} [&ATI TV] {44226DFF-747E-4edc-B30C-78752E50CD0C} [ICQ Lite] {B863453A-26C3-4e1f-A54D-A2CD196348E9} [@btrez.dll,-4015] {CCA281CA-C863-46ef-9331-5C8D4460577F} <, N/A> [Real.com] {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} [Java Plug-in] {8AD9C840-044E-11D1-B3E9-00805F499D93} [CEinstaller Object] {A78856A6-334B-43AF-96F5-58574005910D} [a-squared Scanner] {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} [Java Plug-in] {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} [Java Plug-in] {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} [Java Plug-in 1.5.0_06] {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [QuickTime Object] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [MetaStreamCtl Class] {03F998B2-0E00-11D3-A498-00104B6EB52E} [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [PeerDraw Class] {10072CEC-8CC1-11D1-986E-00A0C955B42E} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} [IconX Class] {37C5D6EF-B34A-45E3-8529-B0443B8BAD3C} [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} [CTVUAxCtrl Object] {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} [HHCtrl Object] {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} [&ATI TV] {44226DFF-747E-4EDC-B30C-78752E50CD0C} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [ModemHelperCom Class] {94BF6C82-F075-11D4-AB95-000102B2D025} [CEinstaller Object] {A78856A6-334B-43AF-96F5-58574005910D} [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [a-squared Scanner] {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} [Adobe Acrobat 7.0 Browser Document] {CA8A9780-280D-11CF-A24D-444553540000} [AUDIO__MID Moniker Class] {CD3AFA74-B84F-48F0-9393-7EDC34128127} [AUDIO__WAV Moniker Class] {CD3AFA7B-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [CPixie Object] {DB54C596-F4B6-4BF7-A38A-B1E0465359EC} [Messenger Class] {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <, N/A> [ZeroBar] {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} [E&xport to Microsoft Excel] [Send To &Bluetooth] ================================== Running Processes [PID: 132][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 180][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 204][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Ati2evxx.dll] [N/A, N/A] [C:\WINDOWS\System32\BCMLogon.dll] [Broadcom Corporation, 1, 0, 0, 1] [PID: 248][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 260][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 412][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 472][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 516][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1336][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Resco\Pocket Encryption\RExpCtxU.dll] [, 1, 0, 0, 1] [PID: 1876][C:\Documents and Settings\Ilya\Desktop\SREng.exe] [Smallfrogs Studio, 2.2.6.605] ================================== File Associations .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock Provider N/A ================================== Autorun.Inf N/A ================================== HOSTS File 127.0.0.1 localhost ==================================
Post #6
And here is what I got after a scan with GMer. I hope this is the right report. Thanks a lot for your help.

GMER 1.0.12.11879 - http://www.gmer.net
Rootkit scan 2006-11-04 17:19:29
Windows 5.1.2600 Service Pack 2


—- Kernel code sections - GMER 1.0.12 —-

.text NTDLL.DLL!NtClose 7C90D586 5 Bytes JMP 7203394A
.text NTDLL.DLL!NtCreateProcess 7C90D754 5 Bytes JMP 72033AD5
.text NTDLL.DLL!NtCreateProcessEx 7C90D769 5 Bytes JMP 720339B9
.text NTDLL.DLL!NtCreateSection 7C90D793 5 Bytes JMP 72033968

—- Files - GMER 1.0.12 —-

ADS C:\Documents and Settings\All Users\Application Data\TEMP:D2F2F703
ADS C:\Program Files\tvants\Tvants.exe:SummaryInformation
ADS C:\Program Files\tvants\Tvants.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

—- EOF - GMER 1.0.12 —-
Post #7 last edited
Please download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose:Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click
  • No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE:If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

STEP 1.
======
AboutBuster
  • Download AboutBuster.
    AboutBuster
  • Unzip AboutBuster in an own folder such as C:\AboutBuster.
  • Start AboutBuster.exe. Click OK, Update, Check For Update and download the updates if present.
  • Start Aboutbuster and let it scan. When the scan is done and you choose exit, it will automatically create a log in the same folder where aboutbuster is in.
  • Please post the results in your next reply.
Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Standard
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
  • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.

Please post (reply) with the results from AboutBuster and Kapersky.
Post #8
Hi. Here is Kaspersky Scan Log. About Booster did not find anything, so i did not include it. Thanks again for your help. ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Tuesday, November 07, 2006 4:22:01 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 7/11/2006 Kaspersky Anti-Virus database records: 225652 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 57381 Number of viruses found: 10 Number of infected objects: 31 / 0 Number of suspicious objects: 0 Duration of the scan process: 00:56:46 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Documents\setup.exe Infected: Trojan-Proxy.Win32.Horst.kz skipped C:\Documents and Settings\Ilya\Application Data\$_hpcst$.hpc Object is locked skipped C:\Documents and Settings\Ilya\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\History\History.IE5\MSHist012006110720061108\index.dat Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\Temp\WCESLog.log Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\Temp\~DF687C.tmp Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\Temp\~DF6887.tmp Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\Temp\~DF6F55.tmp Object is locked skipped C:\Documents and Settings\Ilya\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Ilya\ntuser.dat Object is locked skipped C:\Documents and Settings\Ilya\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Ilya\Share Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Canon\MultiPASS\repos\Db\mpdata.dat Object is locked skipped C:\Program Files\Canon\MultiPASS\repos\Db\mpdata.idx Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP51\A0003023.exe/data.rar Infected: Trojan.RAR.KillWin.d skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP51\A0003023.exe RarSFX: infected - 1 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004139.exe Infected: Trojan-Downloader.Win32.QQHelper.nv skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004170.exe/data.rar Infected: Trojan.RAR.KillWin.d skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004170.exe RarSFX: infected - 1 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004172.exe/data.rar/bind_40036.exe Infected: Trojan-Downloader.Win32.Agent.aym skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004172.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.aym skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004172.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004173.exe Infected: Trojan-Downloader.Win32.Delf.ayh skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004174.exe/data.rar Infected: Trojan.RAR.KillWin.d skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004174.exe RarSFX: infected - 1 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004175.exe Infected: Trojan-Downloader.Win32.Agent.aht skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004177.exe Infected: Backdoor.Win32.IRCBot.xq skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004179.exe/data.rar/bind_40036.exe Infected: Trojan-Downloader.Win32.Agent.aym skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004179.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.aym skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004179.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004180.exe/csrss.exe Infected: Trojan-Downloader.Win32.Agent.awi skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004180.exe ZIP: infected - 1 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004181.exe Infected: Trojan-Downloader.Win32.Delf.ayh skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP57\A0004328.exe Infected: Trojan-Downloader.Win32.QQHelper.nv skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004446.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004449.exe/data.rar/bind_40036.exe Infected: Trojan-Downloader.Win32.Agent.aym skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004449.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.aym skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004449.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004450.exe Infected: Trojan-Downloader.Win32.Delf.ayh skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP60\A0004672.exe Infected: Trojan-Downloader.Win32.QQHelper.nx skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP63\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\setup.exe Infected: Trojan-Proxy.Win32.Horst.kz skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\~tmp1507.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped C:\WINDOWS\~tmp1855.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped C:\WINDOWS\~tmp8322.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped Scan process completed.
Post #9 last edited
Please set your system to show all files; please see here if you're unsure how to do this.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\Documents and Settings\All Users\Documents\setup.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\setup.exe
C:\WINDOWS\~tmp1507.exe
C:\WINDOWS\~tmp1855.exe
C:\WINDOWS\~tmp8322.exe
Exit Explorer,
Empty your Recycle Bin
and reboot as normal afterwards.

Please run Kapersky and post the results to see if we got them. We will take care of the _restore files in another step.
Post #10 last edited
Here is the new Kaspersky log. There are several more '~tmp****.exe' files in the Wndows folder that the scan does not pick up for some reason. I did not touch them, but it seems ilke they are the same type as others. PLease let me know if I should remove them as well. Thanks

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Thursday, November 09, 2006 12:17:51 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 9/11/2006
Kaspersky Anti-Virus database records: 226012
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\

Scan Statistics:
Total number of scanned objects: 66116
Number of viruses found: 6
Number of infected objects: 24 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:06:14

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\Ilya\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\Ilya\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Ilya\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Ilya\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Ilya\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Ilya\Local Settings\History\History.IE5\MSHist012006110920061110\index.dat Object is locked skipped
C:\Documents and Settings\Ilya\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\Ilya\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Ilya\ntuser.dat Object is locked skipped
C:\Documents and Settings\Ilya\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Ilya\Share Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Canon\MultiPASS\repos\Db\mpdata.dat Object is locked skipped
C:\Program Files\Canon\MultiPASS\repos\Db\mpdata.idx Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP51\A0003023.exe/data.rar Infected: Trojan.RAR.KillWin.d skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP51\A0003023.exe RarSFX: infected - 1 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004139.exe Infected: Trojan-Downloader.Win32.QQHelper.nv skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004170.exe/data.rar Infected: Trojan.RAR.KillWin.d skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004170.exe RarSFX: infected - 1 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004172.exe/data.rar/bind_40036.exe Infected: Trojan-Downloader.Win32.Agent.aym skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004172.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.aym skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004172.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004173.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004174.exe/data.rar Infected: Trojan.RAR.KillWin.d skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004174.exe RarSFX: infected - 1 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004175.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004177.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004179.exe/data.rar/bind_40036.exe Infected: Trojan-Downloader.Win32.Agent.aym skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004179.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.aym skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004179.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004180.exe/csrss.exe Infected: Trojan-Downloader.Win32.Agent.awi skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004180.exe ZIP: infected - 1 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP56\A0004181.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP57\A0004328.exe Infected: Trojan-Downloader.Win32.QQHelper.nv skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004446.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004449.exe/data.rar/bind_40036.exe Infected: Trojan-Downloader.Win32.Agent.aym skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004449.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.aym skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004449.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP58\A0004450.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP60\A0004672.exe Infected: Trojan-Downloader.Win32.QQHelper.nx skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP64\A0004802.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP64\A0004803.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP64\A0004804.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP64\A0004805.exe Infected: Trojan-Downloader.Win32.Delf.bau skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped

Scan process completed.
Post #11

There are several more '~tmp****.exe' files in the Wndows folder

These were not infected. Good job! you deleted the infected ones. :)

Please post one more hijackthis log and let me review it.
Post #12
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI