Spyware / Malware / Virus Removal

Qwerty12.exe ? [Resolved]

8 min read

Looking for the outcome? Ask AI

radjap Topic Starter

Post #1July 13, 2007, 8:30 AM UTC

Hiy'all

I'm stumped, My computer has a mind of its own, it opens ie7 and directs my browser to drivecleaner.com something.
I've tried using Ad-aware, NOD32, Norton Antiot, but nothing seems to work.
Help please… Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 5:25:45 PM, on 7/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\qwerty12.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2cdcd8b2-5044-4481-b33c-e20841092012} - C:\WINDOWS\system32\kbd_24.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe"
O4 - HKLM\..\Run: [winehq.org] rundll32.exe "C:\WINDOWS\rqpppp.dll",realset
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\kbd_24.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180721276437
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - AppInit_DLLs: c:\windows\system32\vtutuus.dll
O20 - Winlogon Notify: kbd_24 - C:\WINDOWS\SYSTEM32\kbd_24.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qwerty12.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymantecAntiBotAgent - Unknown owner - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe" SymantecAntiBotAgent (file missing)
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

silver

Post #2July 14, 2007, 3:52 AM UTC

Hi radjap,

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
A log file will be created at C:\vundofix.txt, please post the contents of this in your next response.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Once complete, please post the VundoFix log and a new HijackThis log.

radjap

Post #3July 14, 2007, 5:41 AM UTC

That was fast…Thanks…

===============================================================================
Here's my VundoFix Log:
===============================================================================
VundoFix V6.5.4

Checking Java version…

Sun Java not detected
Scan started at 2:19:29 PM 7/14/2007

Listing files found while scanning….

C:\WINDOWS\system32\tmp3BC.tmp.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\tmp3BC.tmp.dll
C:\WINDOWS\system32\tmp3BC.tmp.dll Has been deleted!

================================================================================
HijackThis Log:
================================================================================
Logfile of HijackThis v1.99.1
Scan saved at 2:36:37 PM, on 7/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2cdcd8b2-5044-4481-b33c-e20841092012} - C:\WINDOWS\system32\kbd_24.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\kbd_24.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180721276437
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - AppInit_DLLs: c:\windows\system32\vtutuus.dll
O20 - Winlogon Notify: kbd_24 - C:\WINDOWS\SYSTEM32\kbd_24.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymantecAntiBotAgent - Unknown owner - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe" SymantecAntiBotAgent (file missing)
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

Much Respect!

silver

Post #4July 14, 2007, 6:13 AM UTC

Hi radjap,

Please run Vundofix once more but add files for it to remove:

Double-click VundoFix.exe to run it.
Right-click the white box in the middle and select Add more files?
Copy the following paths into the boxes:

C:\WINDOWS\SYSTEM32\kbd_24.dll
c:\windows\system32\vtutuus.dll
Then press Add Files, Close Window and then Remove Vundo
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo
When completed, it will prompt that it will reboot your computer, click OK
Post the contents of C:\vundofix.txt in your next response

Next, download ComboFix to your desktop

Double click combofix.exe and follow the prompts.
Note: Do not click ComboFix's window while it's running - it may cause it to stall!
When finished, it shall produce a log for you, please post it in your next response.

Once complete, please post the new Vundofix log, the Combofix log and a new HijackThis log.

radjap

Post #5July 14, 2007, 3:24 PM UTC

Thanks!

Here are my new logs

VundoFix V6.5.4

Checking Java version…

Sun Java not detected
Scan started at 2:19:29 PM 7/14/2007

Listing files found while scanning….

C:\WINDOWS\system32\tmp3BC.tmp.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\tmp3BC.tmp.dll
C:\WINDOWS\system32\tmp3BC.tmp.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal…

Attempting to delete C:\WINDOWS\SYSTEM32\kbd_24.dll
C:\WINDOWS\SYSTEM32\kbd_24.dll Has been deleted!

Attempting to delete c:\windows\system32\vtutuus.dll
c:\windows\system32\vtutuus.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal…

Attempting to delete c:\windows\system32\vtutuus.dll
c:\windows\system32\vtutuus.dll Could not be deleted.

Performing Repairs to the registry.
Done!

============================
VundoFix
============================

VundoFix V6.5.4

Checking Java version…

Sun Java not detected
Scan started at 6:05:00 PM 7/14/2007

Listing files found while scanning….

No infected files were found.

VundoFix V6.5.4

Checking Java version…

Sun Java not detected
Scan started at 11:51:35 PM 7/14/2007

Listing files found while scanning….

No infected files were found.

VundoFix V6.5.4

Checking Java version…

Sun Java not detected
Scan started at 12:09:04 AM 7/15/2007

Listing files found while scanning….

No infected files were found.

=================================
ComboFix log
=================================
"rad" - 2007-07-14 23:40:11 - ComboFix 07-07-14.6 - Service Pack 2 NTFS

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\vtutuus.dll
C:\WINDOWS\ljifcc.dll
C:\WINDOWS\tuvtrq.dll
C:\WINDOWS\system32\jkhhi.exe
C:\WINDOWS\ccfijl.ini
C:\WINDOWS\qrtvut.ini
C:\WINDOWS\system32\CTSnds.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\rad\APPLIC~1\tmp1266.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp2B9.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp385.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp3BC.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp41.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp52B.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp538.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp614.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmp99.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmpA54.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmpAAA.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmpF43.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmpF6F.tmp.exe
C:\DOCUME~1\rad\APPLIC~1\tmpF79.tmp.exe
C:\WINDOWS\system32\dn7ccbf94f.dat
C:\WINDOWS\system32\tmpF43.tmp.dll

((((((((((((((((((((((((( Files Created from 2007-06-14 to 2007-07-14 )))))))))))))))))))))))))))))))

2007-07-14 23:39 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-14 14:51 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-14 14:19 d——– C:\VundoFix Backups
2007-07-11 21:49 d——– C:\Program Files\Symantec
2007-07-11 21:49 d——– C:\DOCUME~1\rad\APPLIC~1\Symantec
2007-07-11 21:48 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
2007-07-08 22:10 d——– C:\WINDOWS\BDOSCAN8
2007-06-30 01:13 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-27 23:58 d–h—– C:\WINDOWS\PIF
2007-06-27 23:33 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-06-26 22:03 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2007-06-26 22:03 298,104 –a—— C:\WINDOWS\system32\imon.dll
2007-06-26 22:03 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2007-06-23 23:46 d——– C:\DOCUME~1\rad\APPLIC~1\CyberLink
2007-06-23 23:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-06-23 23:43 d——– C:\Program Files\CyberLink
2007-06-22 08:26 d——– C:\WINDOWS\RegisteredPackages
2007-06-19 01:03 d——– C:\Program Files\WinAVI Video Capture
2007-06-18 00:37 d——– C:\Program Files\Share_Accelerator_MM
2007-06-18 00:36 434,252 –a—— C:\WINDOWS\system32\Msvcrtd.dll
2007-06-18 00:36 d——– C:\Program Files\Zapu
2007-06-18 00:00 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-06-18 00:00 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-06-18 00:00 344,064 –a—— C:\WINDOWS\system32\MSVCR70.DLL
2007-06-18 00:00 d——– C:\Program Files\Fake Webcam
2007-06-17 23:43 d——– C:\Program Files\Hotspot Shield
2007-06-17 23:39 d——– C:\DOCUME~1\rad\APPLIC~1\vlc
2007-06-17 22:35 d——– C:\Program Files\TVUPlayer
2007-06-17 18:11 719,872 –a—— C:\WINDOWS\system32\devil.dll
2007-06-17 18:11 314,368 –a—— C:\WINDOWS\system32\avisynth.dll
2007-06-17 18:11 d——– C:\Program Files\Magic iPod Video Converter
2007-06-17 15:04 17,920 –a—— C:\WINDOWS\system32\mdimon.dll
2007-06-17 14:59 d——– C:\Program Files\Microsoft ActiveSync
2007-06-17 14:59 d——– C:\Program Files\Common Files\L&H
2007-06-17 14:57 d——– C:\WINDOWS\SHELLNEW
2007-06-17 14:57 d——– C:\Program Files\Microsoft.NET
2007-06-17 14:57 d——– C:\Program Files\Microsoft Works
2007-06-17 09:48 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-06-17 03:38 d——– C:\cabs
2007-06-15 21:16 d——– C:\Program Files\EA SPORTS
2007-06-14 08:15 1 –a—— C:\WINDOWS\system32\SI.bin
2007-06-14 08:15 d——– C:\Program Files\Ubisoft
2007-06-14 00:17 d——– C:\Program Files\Common Files\DirectX
2007-06-14 00:16 d——– C:\Program Files\MotoGP

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-14 01:29:21 23,524 —-a-w C:\WINDOWS\system32\drivers\GVTDrv.sys
2007-07-13 10:57:42 ——– d—–w C:\Program Files\3GP Player
2007-06-29 23:59:35 ——– d—–w C:\Program Files\BearShare
2007-06-27 14:32:37 ——– d—–w C:\Program Files\Trojan Remover
2007-06-24 13:47:52 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\U3
2007-06-23 14:43:28 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-21 23:28:02 ——– d—–w C:\Program Files\Creative
2007-06-21 23:24:59 ——– d–h–w C:\Program Files\Creative Installation Information
2007-06-16 02:10:43 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\DivX
2007-06-13 14:10:31 ——– d—–w C:\Program Files\BitTorrent
2007-06-12 16:20:17 ——– d—–w C:\Program Files\CAPCOM
2007-06-12 15:16:09 ——– d—–w C:\Program Files\EA GAMES
2007-06-12 11:38:55 ——– d—–w C:\Program Files\Ahead
2007-06-12 11:38:54 ——– d—–w C:\Program Files\Common Files\Ahead
2007-06-10 22:45:04 ——– d—–w C:\Program Files\Alcohol Soft
2007-06-08 18:01:59 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\BitTorrent
2007-06-07 22:03:02 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Yahoo!
2007-06-04 15:13:47 ——– d—–w C:\Program Files\Passware
2007-06-04 15:13:47 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Help
2007-06-04 15:12:59 ——– d—–w C:\Program Files\Counter-Strike 1.6
2007-06-04 14:41:40 ——– d—–w C:\Program Files\Registry Purify
2007-06-03 11:54:34 8 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-06-03 02:35:31 ——– d—–w C:\Program Files\Messenger
2007-06-03 02:26:05 682,232 —-a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-06-02 04:04:53 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Creative
2007-06-02 01:37:50 ——– d—–w C:\Program Files\Common Files\ODBC
2007-06-02 01:37:48 ——– d—–w C:\Program Files\Common Files\SpeechEngines
2007-06-02 01:20:19 ——– d—–w C:\Program Files\Chikka Messenger
2007-06-02 01:13:00 ——– d—–w C:\Program Files\Yahoo!
2007-06-01 19:41:15 1,156 —-a-w C:\WINDOWS\mozver.dat
2007-06-01 19:40:34 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Talkback
2007-06-01 19:40:27 0 —-a-w C:\WINDOWS\nsreg.dat
2007-06-01 19:06:31 ——– d—–w C:\Program Files\DivX
2007-06-01 18:33:35 ——– d—–w C:\Program Files\GigaByte
2007-06-01 18:26:30 ——– d—–w C:\Program Files\Ashampoo
2007-06-01 18:25:49 ——– d—–w C:\Program Files\Lavasoft
2007-06-01 18:25:40 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\WinRAR
2007-06-01 18:08:30 ——– d–h–w C:\Program Files\WindowsUpdate
2007-06-01 17:48:10 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Simply Super Software
2007-06-01 17:45:25 ——– d—–w C:\Program Files\Common Files\Cisco Systems
2007-06-01 17:38:28 ——– d—–w C:\Program Files\Common Files\Creative
2007-06-01 17:37:11 86,016 —-a-w C:\WINDOWS\system32\OpenAL32.dll
2007-06-01 17:37:11 409,600 —-a-w C:\WINDOWS\system32\wrap_oal.dll
2007-06-01 17:23:51 ——– d—–w C:\Program Files\Common Files\InstallShield
2007-06-01 17:14:09 ——– d—–w C:\Program Files\Movie Maker
2007-06-01 17:11:19 ——– d—–w C:\Program Files\Windows NT
2007-06-01 16:55:31 ——– d—–w C:\Program Files\Western Digital
2007-06-01 16:47:15 ——– d—–w C:\Program Files\microsoft frontpage
2007-06-01 16:46:51 0 –sha-r C:\MSDOS.SYS
2007-06-01 16:46:51 0 –sha-r C:\IO.SYS
2007-06-01 16:46:51 0 —-a-w C:\CONFIG.SYS
2007-06-01 16:46:51 0 —-a-w C:\AUTOEXEC.BAT
2007-06-01 16:45:26 ——– d—–w C:\Program Files\Online Services
2007-06-01 16:44:21 ——– d—–w C:\Program Files\Common Files\MSSoap
2007-06-01 16:43:42 21,640 —-a-w C:\WINDOWS\system32\emptyregdb.dat
2007-06-01 16:43:07 ——– d—–w C:\Program Files\MSN Gaming Zone
2007-05-31 06:45:07 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 —-a-w C:\WINDOWS\system32\DivX.dll
2007-04-23 00:15:29 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-04-23 00:15:24 129,784 ——w C:\WINDOWS\system32\pxafs.dll
2007-04-23 00:15:24 118,520 ——w C:\WINDOWS\system32\pxinsi64.exe
2007-04-23 00:15:24 116,472 ——w C:\WINDOWS\system32\pxcpyi64.exe
2007-04-23 00:15:18 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-04-23 00:02:34 73,728 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-04-23 00:02:34 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-04-23 00:02:33 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-04-23 00:02:31 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-04-23 00:02:31 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-04-23 00:02:31 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-04-23 00:01:47 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 —-a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2007-03-21 06:39 803864 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2cdcd8b2-5044-4481-b33c-e20841092012}]
C:\WINDOWS\system32\kbd_24.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A263CF7-56A6-4D68-A8CF-345BE45BC911}]
2007-02-24 08:04 140840 –a—— C:\Program Files\Yahoo!\Search\YSearchSuggest.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
2006-11-01 05:33 198136 –a—— C:\Program Files\Yahoo!\Common\yiesrvc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 C:\WINDOWS\system32\SPIRun.dll]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 09:56]
"CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 11:43]
"DefragTaskBar"="C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [2007-02-12 12:57]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-06-26 22:02]
"NortonAntiBot"="C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe" [2007-05-29 01:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 01:24]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"AFProg"="C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe" [2006-06-26 11:26]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\vtutuus.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0203a6db-1540-11dc-ab6c-0002a5f6912e}]
AutoRun\command- I:\RavMon.exe
explore\Command- I:\RavMon.exe -e
open\Command- I:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bdce827-14f1-11dc-ab6b-0002a5f6912e}]
AutoRun\command- J:\LaunchU3.exe -a

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-14 23:47:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-14 23:49:48 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-14 23:49

— E O F —

===================================
HijackThis Log
===================================
Logfile of HijackThis v1.99.1
Scan saved at 11:54:05 PM, on 7/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2cdcd8b2-5044-4481-b33c-e20841092012} - C:\WINDOWS\system32\kbd_24.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180721276437
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - AppInit_DLLs: c:\windows\system32\vtutuus.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymantecAntiBotAgent - Unknown owner - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe" SymantecAntiBotAgent (file missing)
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

silver

Post #6July 15, 2007, 3:18 AM UTC

Hi radjap,

Next, please run ComboFix once more using these instructions:

Check that combofix.exe is on your Desktop
Then open Notepad: press Start->Run, type notepad and click OK

Copy/paste the contents of the below code box into Notepad:

File::
C:\WINDOWS\rqpppp.dll
c:\windows\system32\vtutuus.dll
C:\WINDOWS\system32\qwerty12.exe
Driver::
DomainService

Save this as CFScript.txt and change the Save as type to All Files and save it to your Desktop.

[external image: Posted Image]
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

Note: Do not click ComboFix's window while it's running - it may cause it to stall!

Once complete, please post the new ComboFix log and a new HijackThis log.

radjap

Post #7July 15, 2007, 1:49 PM UTC

Here are my new logs. Thanks.

================================
ComboFix Log:
================================
"rad" - 2007-07-15 22:35:46 - ComboFix 07-07-14.6 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\rad\Desktop\CFScript.txt

((((((((((((((((((((((((( Files Created from 2007-06-15 to 2007-07-15 )))))))))))))))))))))))))))))))

2007-07-15 12:03 d——– C:\WINDOWS\pss
2007-07-15 03:28 4,192 –a—— C:\WINDOWS\system\WBTRVRES.DLL
2007-07-15 03:28 101,163 –a—— C:\WINDOWS\system\WDBUEI32.DLL
2007-07-15 03:28 100,864 –a—— C:\WINDOWS\system\WDBUUI32.DLL
2007-07-15 03:27 954,640 –a—— C:\WINDOWS\system\MFC42.DLL
2007-07-15 03:27 935,632 –a—— C:\WINDOWS\system\VB40016.DLL
2007-07-15 03:27 9,136 –a—— C:\WINDOWS\system\INETWH16.DLL
2007-07-15 03:27 7,776 –a—— C:\WINDOWS\system\APIGUIDE.DLL
2007-07-15 03:27 68,096 –a—— C:\WINDOWS\system\WBTRV32.DLL
2007-07-15 03:27 67,584 –a—— C:\WINDOWS\system\W32MKSET.DLL
2007-07-15 03:27 57,328 –a—— C:\WINDOWS\system\OLE2CONV.DLL
2007-07-15 03:27 536,048 –a—— C:\WINDOWS\system\OC25.DLL
2007-07-15 03:27 51,712 –a—— C:\WINDOWS\system\OLE2PROX.DLL
2007-07-15 03:27 5,824 –a—— C:\WINDOWS\system\WBTRTHNK.DLL
2007-07-15 03:27 43,472 –a—— C:\WINDOWS\system\WBTRCALL.DLL
2007-07-15 03:27 397,312 –a—— C:\WINDOWS\system\W32MKSET.EXE
2007-07-15 03:27 38,576 –a—— C:\WINDOWS\system\NWLOCALE.DLL
2007-07-15 03:27 35,328 –a—— C:\WINDOWS\system\INETWH32.DLL
2007-07-15 03:27 320,512 –a—— C:\WINDOWS\system\W32MKDE.EXE
2007-07-15 03:27 304,640 –a—— C:\WINDOWS\system\OLE2.DLL
2007-07-15 03:27 28,113 –a—— C:\WINDOWS\system\OLE2.REG
2007-07-15 03:27 27,632 –a—— C:\WINDOWS\system\CTL3DV2.DLL
2007-07-15 03:27 226,304 –a—— C:\WINDOWS\system\OLEPRO32.DLL
2007-07-15 03:27 177,824 –a—— C:\WINDOWS\system\TYPELIB.DLL
2007-07-15 03:27 164,960 –a—— C:\WINDOWS\system\OLE2DISP.DLL
2007-07-15 03:27 157,696 –a—— C:\WINDOWS\system\STORAGE.DLL
2007-07-15 03:27 152,976 –a—— C:\WINDOWS\system\OLE2NLS.DLL
2007-07-15 03:27 146,976 –a—— C:\WINDOWS\system\MFCOLEUI.DLL
2007-07-15 03:27 12,976 –a—— C:\WINDOWS\system\SCP.DLL
2007-07-15 03:27 110,080 –a—— C:\WINDOWS\system\W32MKRC.DLL
2007-07-15 03:27 109,056 –a—— C:\WINDOWS\system\COMPOBJ.DLL
2007-07-15 03:25 d——– C:\P3WIN
2007-07-15 03:24 307,004 –a—— C:\WINDOWS\ISUN16.EXE
2007-07-15 03:24 26,768 –a—— C:\WINDOWS\system\CTL3D.DLL
2007-07-15 03:24 d——– C:\DOCUME~1\rad\WINDOWS
2007-07-15 00:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-07-14 23:39 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-14 14:51 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-14 14:19 d——– C:\VundoFix Backups
2007-07-11 21:49 d——– C:\Program Files\Symantec
2007-07-11 21:49 d——– C:\DOCUME~1\rad\APPLIC~1\Symantec
2007-07-11 21:48 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
2007-07-08 22:10 d——– C:\WINDOWS\BDOSCAN8
2007-06-30 01:13 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-27 23:58 d–h—– C:\WINDOWS\PIF
2007-06-27 23:33 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-06-26 22:03 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2007-06-26 22:03 298,104 –a—— C:\WINDOWS\system32\imon.dll
2007-06-26 22:03 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2007-06-23 23:46 d——– C:\DOCUME~1\rad\APPLIC~1\CyberLink
2007-06-23 23:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
2007-06-23 23:43 d——– C:\Program Files\CyberLink
2007-06-22 08:26 d——– C:\WINDOWS\RegisteredPackages
2007-06-19 01:03 d——– C:\Program Files\WinAVI Video Capture
2007-06-18 00:37 d——– C:\Program Files\Share_Accelerator_MM
2007-06-18 00:36 434,252 –a—— C:\WINDOWS\system32\Msvcrtd.dll
2007-06-18 00:36 d——– C:\Program Files\Zapu
2007-06-18 00:00 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-06-18 00:00 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-06-18 00:00 344,064 –a—— C:\WINDOWS\system32\MSVCR70.DLL
2007-06-18 00:00 d——– C:\Program Files\Fake Webcam
2007-06-17 23:43 d——– C:\Program Files\Hotspot Shield
2007-06-17 23:39 d——– C:\DOCUME~1\rad\APPLIC~1\vlc
2007-06-17 22:35 d——– C:\Program Files\TVUPlayer
2007-06-17 18:11 719,872 –a—— C:\WINDOWS\system32\devil.dll
2007-06-17 18:11 314,368 –a—— C:\WINDOWS\system32\avisynth.dll
2007-06-17 18:11 d——– C:\Program Files\Magic iPod Video Converter
2007-06-17 15:04 17,920 –a—— C:\WINDOWS\system32\mdimon.dll
2007-06-17 14:59 d——– C:\Program Files\Microsoft ActiveSync
2007-06-17 14:59 d——– C:\Program Files\Common Files\L&H
2007-06-17 14:57 d——– C:\WINDOWS\SHELLNEW
2007-06-17 14:57 d——– C:\Program Files\Microsoft.NET
2007-06-17 14:57 d——– C:\Program Files\Microsoft Works
2007-06-17 09:48 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-06-17 03:38 d——– C:\cabs
2007-06-15 21:16 d——– C:\Program Files\EA SPORTS

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-14 18:28:03 11 —-a-w C:\CONFIG.SYS
2007-07-14 14:59:18 ——– d—–w C:\Program Files\3GP Player
2007-07-14 01:29:21 23,524 —-a-w C:\WINDOWS\system32\drivers\GVTDrv.sys
2007-06-29 23:59:35 ——– d—–w C:\Program Files\BearShare
2007-06-27 14:32:37 ——– d—–w C:\Program Files\Trojan Remover
2007-06-24 13:47:52 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\U3
2007-06-23 14:43:28 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-21 23:28:02 ——– d—–w C:\Program Files\Creative
2007-06-21 23:24:59 ——– d–h–w C:\Program Files\Creative Installation Information
2007-06-16 02:10:43 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\DivX
2007-06-13 23:15:34 ——– d—–w C:\Program Files\Ubisoft
2007-06-13 23:15:31 1 —-a-w C:\WINDOWS\system32\SI.bin
2007-06-13 15:18:18 ——– d—–w C:\Program Files\MotoGP
2007-06-13 15:17:33 ——– d—–w C:\Program Files\Common Files\DirectX
2007-06-13 14:10:31 ——– d—–w C:\Program Files\BitTorrent
2007-06-12 16:20:17 ——– d—–w C:\Program Files\CAPCOM
2007-06-12 15:16:09 ——– d—–w C:\Program Files\EA GAMES
2007-06-12 11:38:55 ——– d—–w C:\Program Files\Ahead
2007-06-12 11:38:54 ——– d—–w C:\Program Files\Common Files\Ahead
2007-06-10 22:45:04 ——– d—–w C:\Program Files\Alcohol Soft
2007-06-08 18:01:59 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\BitTorrent
2007-06-07 22:03:02 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Yahoo!
2007-06-04 15:13:47 ——– d—–w C:\Program Files\Passware
2007-06-04 15:13:47 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Help
2007-06-04 15:12:59 ——– d—–w C:\Program Files\Counter-Strike 1.6
2007-06-04 14:41:40 ——– d—–w C:\Program Files\Registry Purify
2007-06-03 11:54:34 8 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-06-03 02:35:31 ——– d—–w C:\Program Files\Messenger
2007-06-03 02:26:05 682,232 —-a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-06-02 04:04:53 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Creative
2007-06-02 01:37:50 ——– d—–w C:\Program Files\Common Files\ODBC
2007-06-02 01:37:48 ——– d—–w C:\Program Files\Common Files\SpeechEngines
2007-06-02 01:20:19 ——– d—–w C:\Program Files\Chikka Messenger
2007-06-02 01:13:00 ——– d—–w C:\Program Files\Yahoo!
2007-06-01 19:41:15 1,156 —-a-w C:\WINDOWS\mozver.dat
2007-06-01 19:40:34 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Talkback
2007-06-01 19:40:27 0 —-a-w C:\WINDOWS\nsreg.dat
2007-06-01 19:06:31 ——– d—–w C:\Program Files\DivX
2007-06-01 18:33:35 ——– d—–w C:\Program Files\GigaByte
2007-06-01 18:26:30 ——– d—–w C:\Program Files\Ashampoo
2007-06-01 18:25:49 ——– d—–w C:\Program Files\Lavasoft
2007-06-01 18:25:40 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\WinRAR
2007-06-01 18:08:30 ——– d–h–w C:\Program Files\WindowsUpdate
2007-06-01 17:48:10 ——– d—–w C:\DOCUME~1\rad\APPLIC~1\Simply Super Software
2007-06-01 17:45:25 ——– d—–w C:\Program Files\Common Files\Cisco Systems
2007-06-01 17:38:28 ——– d—–w C:\Program Files\Common Files\Creative
2007-06-01 17:37:11 86,016 —-a-w C:\WINDOWS\system32\OpenAL32.dll
2007-06-01 17:37:11 409,600 —-a-w C:\WINDOWS\system32\wrap_oal.dll
2007-06-01 17:23:51 ——– d—–w C:\Program Files\Common Files\InstallShield
2007-06-01 17:14:09 ——– d—–w C:\Program Files\Movie Maker
2007-06-01 17:11:19 ——– d—–w C:\Program Files\Windows NT
2007-06-01 16:55:31 ——– d—–w C:\Program Files\Western Digital
2007-06-01 16:47:15 ——– d—–w C:\Program Files\microsoft frontpage
2007-06-01 16:46:51 0 –sha-r C:\MSDOS.SYS
2007-06-01 16:46:51 0 –sha-r C:\IO.SYS
2007-06-01 16:46:51 0 —-a-w C:\AUTOEXEC.BAT
2007-06-01 16:45:26 ——– d—–w C:\Program Files\Online Services
2007-06-01 16:44:21 ——– d—–w C:\Program Files\Common Files\MSSoap
2007-06-01 16:43:42 21,640 —-a-w C:\WINDOWS\system32\emptyregdb.dat
2007-06-01 16:43:07 ——– d—–w C:\Program Files\MSN Gaming Zone
2007-05-31 06:45:07 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-31 06:44:55 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 06:44:54 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 06:44:54 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 06:44:54 740,442 —-a-w C:\WINDOWS\system32\DivX.dll
2007-04-23 00:15:29 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2007-04-23 00:15:24 129,784 ——w C:\WINDOWS\system32\pxafs.dll
2007-04-23 00:15:24 118,520 ——w C:\WINDOWS\system32\pxinsi64.exe
2007-04-23 00:15:24 116,472 ——w C:\WINDOWS\system32\pxcpyi64.exe
2007-04-23 00:15:18 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2007-04-23 00:02:34 73,728 —-a-w C:\WINDOWS\system32\dpl100.dll
2007-04-23 00:02:34 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll
2007-04-23 00:02:33 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll
2007-04-23 00:02:31 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll
2007-04-23 00:02:31 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll
2007-04-23 00:02:31 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll
2007-04-23 00:01:47 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 —-a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2007-03-21 06:39 803864 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2cdcd8b2-5044-4481-b33c-e20841092012}]
C:\WINDOWS\system32\kbd_24.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 –a—— C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A263CF7-56A6-4D68-A8CF-345BE45BC911}]
2007-02-24 08:04 140840 –a—— C:\Program Files\Yahoo!\Search\YSearchSuggest.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
2006-11-01 05:33 198136 –a—— C:\Program Files\Yahoo!\Common\yiesrvc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"P17Helper"="SPIRun.dll" [2006-07-03 12:43 C:\WINDOWS\system32\SPIRun.dll]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 09:56]
"CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 11:43]
"DefragTaskBar"="C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [2007-02-12 12:57]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-06-26 22:02]
"NortonAntiBot"="C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe" [2007-05-29 01:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 01:24]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"AFProg"="C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe" [2006-06-26 11:26]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\vtutuus.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0203a6db-1540-11dc-ab6c-0002a5f6912e}]
AutoRun\command- I:\RavMon.exe
explore\Command- I:\RavMon.exe -e
open\Command- I:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bdce827-14f1-11dc-ab6b-0002a5f6912e}]
AutoRun\command- J:\LaunchU3.exe -a

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-15 22:38:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-15 22:41:15
C:\ComboFix-quarantined-files.txt … 2007-07-15 22:41
C:\ComboFix2.txt … 2007-07-15 13:59
C:\ComboFix3.txt … 2007-07-15 00:17

— E O F —

================================
HijackThis Log
================================

Logfile of HijackThis v1.99.1
Scan saved at 10:45:14 PM, on 7/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2cdcd8b2-5044-4481-b33c-e20841092012} - C:\WINDOWS\system32\kbd_24.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180721276437
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - AppInit_DLLs: c:\windows\system32\vtutuus.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymantecAntiBotAgent - Unknown owner - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe" SymantecAntiBotAgent (file missing)
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

silver

Post #8July 15, 2007, 11:49 PM UTC

Hi radjap,

Download OTMoveIt to your desktop. and double-click the program to start it.
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
Then, press MoveIt!
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.

OTMoveIt file list:

c:\windows\system32\vtutuus.dll

Then, open HijackThis, choose Do a system scan only and place a checkmark next to the following lines (if present):

O2 - BHO: (no name) - {2cdcd8b2-5044-4481-b33c-e20841092012} - C:\WINDOWS\system32\kbd_24.dll (file missing)
O20 - AppInit_DLLs: c:\windows\system32\vtutuus.dll

Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

Now reboot your computer normally.

Once complete, please post the OTMoveIt log and a new HijackThis log.

radjap

Post #9July 16, 2007, 9:34 AM UTC

Here are my new logs…Am I in the clear yet? Most of the abnormal things that were happening before in my computer is non-existent now…Yeah!

==============================================
MoveIt Log
==============================================
File/Folder c:\windows\system32\vtutuus.dll not found.

Created on 07/16/2007 13:29:27

==============================================
HijackThis Log
==============================================

Logfile of HijackThis v1.99.1
Scan saved at 10:45:14 PM, on 7/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2cdcd8b2-5044-4481-b33c-e20841092012} - C:\WINDOWS\system32\kbd_24.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180721276437
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - AppInit_DLLs: c:\windows\system32\vtutuus.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymantecAntiBotAgent - Unknown owner - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe" SymantecAntiBotAgent (file missing)
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

silver

Post #10July 16, 2007, 11:21 AM UTC

Hi, We're nearly there

the infection which has been causing the symptoms is likely to be gone now, but we have a couple further checks to do. The OTMoveIt log was fine but the HijackThis log was the old one from your last post, please run HijackThis again and post a new log.

radjap

Post #11July 16, 2007, 11:52 AM UTC

Ooops my bad…

Here's my new log:

Logfile of HijackThis v1.99.1
Scan saved at 8:49:00 PM, on 7/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180721276437
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymantecAntiBotAgent - Unknown owner - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe" SymantecAntiBotAgent (file missing)
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

silver

Post #12July 16, 2007, 1:13 PM UTC

Hi radjap,

That looks better

Please do an online scan with Kaspersky:

Open Kaspersky Online Scanner in Internet Explorer

You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT and then Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
The program will start to scan your system.
Once the scan is complete, click on the Save as Text button and save the file to your desktop

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license is accepted, reset to 100%.

Once complete, please post the Kaspersky log and a new HijackThis log.

radjap

Post #13July 17, 2007, 2:13 PM UTC

Here are my new logs…
Thanks!

==============================
Kaspersky Log
==============================
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, July 17, 2007 7:59:22 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 16/07/2007
Kaspersky Anti-Virus database records: 340434
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
I:\

Scan Statistics:
Total number of scanned objects: 52495
Number of viruses found: 3
Number of infected objects: 3 / 0
Number of suspicious objects: 0
Duration of the scan process: 05:58:09

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\rad\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\rad\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\rad\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\rad\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\rad\Local Settings\History\History.IE5\MSHist012007071620070717\index.dat Object is locked skipped
C:\Documents and Settings\rad\Local Settings\Temp\Perflib_Perfdata_284.dat Object is locked skipped
C:\Documents and Settings\rad\Local Settings\Temp\~DFE4F0.tmp Object is locked skipped
C:\Documents and Settings\rad\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\rad\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\rad\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-07-16.13-35-02.log Object is locked skipped
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\log\log_main.txt Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\infected\FUQTY3BA.NQF Infected: Trojan.Win32.Agent.aoy skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\Program Files\Hotspot Shield\log\oas.log Object is locked skipped
C:\Program Files\Symantec\Norton AntiBot\agent\log\NABAgent.log Object is locked skipped
C:\Program Files\Symantec\Norton AntiBot\agent\log\NABAgent_boot.log Object is locked skipped
C:\Program Files\Symantec\Norton AntiBot\agent\log\NABAgent_graph.log Object is locked skipped
C:\Program Files\Symantec\Norton AntiBot\agent\log\NABAgent_malware.log Object is locked skipped
C:\Program Files\Symantec\Norton AntiBot\agent\log\NABAgent_node.log Object is locked skipped
C:\Program Files\Symantec\Norton AntiBot\agent\log\NABAgent_removed.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\billing_rad.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\client_rad.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\network_rad.log Object is locked skipped
C:\QooBox\Quarantine\C\DOCUME~1\rad\APPLIC~1\tmp52B.tmp.exe.vir Infected: Trojan.Win32.BHO.bd skipped
C:\QooBox\Quarantine\C\DOCUME~1\rad\APPLIC~1\tmpA54.tmp.exe.vir Infected: Trojan.Win32.Pakes skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\APP.LOG Object is locked skipped
E:\codecs\install.txt Object is locked skipped
E:\codecs\M$MPEG4.inf Object is locked skipped
E:\codecs\MPG4C32.dll Object is locked skipped
E:\codecs\mpg4ds32.ax Object is locked skipped
E:\codecs\Msaud32.acm Object is locked skipped
E:\codecs\readme.txt Object is locked skipped
E:\codecs\readme_msaud32.txt Object is locked skipped
E:\data\battle\battle.lgp Object is locked skipped
E:\data\battle\camdat0.bin Object is locked skipped
E:\data\battle\camdat1.bin Object is locked skipped
E:\data\battle\camdat2.bin Object is locked skipped
E:\data\battle\co.bin Object is locked skipped
E:\data\battle\enemy012.dat Object is locked skipped
E:\data\battle\enemy331.dat Object is locked skipped
E:\data\battle\kage.dat Object is locked skipped
E:\data\battle\magic.lgp Object is locked skipped
E:\data\battle\mark.dat Object is locked skipped
E:\data\battle\rain7.tex Object is locked skipped
E:\data\battle\scene.bin Object is locked skipped
E:\data\battle\seffect1.tex Object is locked skipped
E:\data\battle\seffect2.tex Object is locked skipped
E:\data\battle\seffect3.tex Object is locked skipped
E:\data\battle\sky_a.lmd Object is locked skipped
E:\data\battle\sky_b.ply Object is locked skipped
E:\data\battle\sky_c.lmd Object is locked skipped
E:\data\battle\sky_d.ply Object is locked skipped
E:\data\battle\STAGE57.DAT Object is locked skipped
E:\data\cd\cr_us.lgp Object is locked skipped
E:\data\cd\disc_us.lgp Object is locked skipped
E:\data\cd\moviecam.lgp Object is locked skipped
E:\data\field\char.lgp Object is locked skipped
E:\data\field\flevel.lgp Object is locked skipped
E:\data\kernel\KERNEL.BIN Object is locked skipped
E:\data\kernel\kernel2.bin Object is locked skipped
E:\data\kernel\WINDOW.BIN Object is locked skipped
E:\data\menu\menu_us.lgp Object is locked skipped
E:\data\midi\awe.lgp Object is locked skipped
E:\data\midi\midi.lgp Object is locked skipped
E:\data\midi\sf2\FF7.sf2 Object is locked skipped
E:\data\midi\sf2\FF7m.sf2 Object is locked skipped
E:\data\midi\sf2\ff7s.SF2 Object is locked skipped
E:\data\midi\sf2\lb2.SF2 Object is locked skipped
E:\data\midi\xg.lgp Object is locked skipped
E:\data\midi\ygm.lgp Object is locked skipped
E:\data\minigame\chocobo.lgp Object is locked skipped
E:\data\minigame\coaster.lgp Object is locked skipped
E:\data\minigame\condor.lgp Object is locked skipped
E:\data\minigame\high-us.lgp Object is locked skipped
E:\data\minigame\snowboard-us.lgp Object is locked skipped
E:\data\minigame\sub.lgp Object is locked skipped
E:\data\movies\BIGLIGHT.AVI Object is locked skipped
E:\data\movies\BIKE.AVI Object is locked skipped
E:\data\movies\BISKDEAD.AVI Object is locked skipped
E:\data\movies\BOOGDEMO.AVI Object is locked skipped
E:\data\movies\BOOGDOWN.AVI Object is locked skipped
E:\data\movies\BOOGSTAR.AVI Object is locked skipped
E:\data\movies\BOOGUP.AVI Object is locked skipped
E:\data\movies\BRGNVL.AVI Object is locked skipped
E:\data\movies\CANON.AVI Object is locked skipped
E:\data\movies\CANONH1P.AVI Object is locked skipped
E:\data\movies\CANONH3F.AVI Object is locked skipped
E:\data\movies\CANONHT0.AVI Object is locked skipped
E:\data\movies\CANONHT1.AVI Object is locked skipped
E:\data\movies\CANONHT2.AVI Object is locked skipped
E:\data\movies\CANONON.AVI Object is locked skipped
E:\data\movies\Car_1209.avi Object is locked skipped
E:\data\movies\C_SCENE1.AVI Object is locked skipped
E:\data\movies\C_SCENE2.AVI Object is locked skipped
E:\data\movies\C_SCENE3.AVI Object is locked skipped
E:\data\movies\DUMCRUSH.AVI Object is locked skipped
E:\data\movies\D_ROPEGO.AVI Object is locked skipped
E:\data\movies\D_ROPEIN.AVI Object is locked skipped
E:\data\movies\EARITHDD.AVI Object is locked skipped
E:\data\movies\eidoslogo.avi Object is locked skipped
E:\data\movies\ENDING1.AVI Object is locked skipped
E:\data\movies\Ending2.avi Object is locked skipped
E:\data\movies\ENDING3.AVI Object is locked skipped
E:\data\movies\Explode.avi Object is locked skipped
E:\data\movies\FALLPL.AVI Object is locked skipped
E:\data\movies\Fcar.avi Object is locked skipped
E:\data\movies\FEELWIN0.AVI Object is locked skipped
E:\data\movies\FEELWIN1.AVI Object is locked skipped
E:\data\movies\FSHIP2.AVI Object is locked skipped
E:\data\movies\FUNERAL.AVI Object is locked skipped
E:\data\movies\GELNICA.AVI Object is locked skipped
E:\data\movies\GOLD1.AVI Object is locked skipped
E:\data\movies\GOLD2.AVI Object is locked skipped
E:\data\movies\GOLD3.AVI Object is locked skipped
E:\data\movies\GOLD4.AVI Object is locked skipped
E:\data\movies\GOLD5.AVI Object is locked skipped
E:\data\movies\GOLD6.AVI Object is locked skipped
E:\data\movies\GOLD7.AVI Object is locked skipped
E:\data\movies\GOLD7_2.AVI Object is locked skipped
E:\data\movies\GREATPIT.AVI Object is locked skipped
E:\data\movies\HIWIND0.AVI Object is locked skipped
E:\data\movies\HWINDFLY.AVI Object is locked skipped
E:\data\movies\HWINDJET.AVI Object is locked skipped
E:\data\movies\JAIROFAL.AVI Object is locked skipped
E:\data\movies\JAIROFLY.AVI Object is locked skipped
E:\data\movies\JENOVA_E.AVI Object is locked skipped
E:\data\movies\JUNAIR_D.AVI Object is locked skipped
E:\data\movies\JUNAIR_U.AVI Object is locked skipped
E:\data\movies\JUNELEGO.AVI Object is locked skipped
E:\data\movies\JUNELEIN.AVI Object is locked skipped
E:\data\movies\JUNIN_GO.AVI Object is locked skipped
E:\data\movies\JUNIN_IN.AVI Object is locked skipped
E:\data\movies\JUNON.AVI Object is locked skipped
E:\data\movies\JUNSEA.AVI Object is locked skipped
E:\data\movies\LAST4_2.AVI Object is locked skipped
E:\data\movies\LAST4_3.AVI Object is locked skipped
E:\data\movies\LAST4_4.AVI Object is locked skipped
E:\data\movies\LASTFLOR.AVI Object is locked skipped
E:\data\movies\LASTMAP.AVI Object is locked skipped
E:\data\movies\LOSLAKE1.AVI Object is locked skipped
E:\data\movies\LSLMV.AVI Object is locked skipped
E:\data\movies\MAINPLR.AVI Object is locked skipped
E:\data\movies\METEOFIX.AVI Object is locked skipped
E:\data\movies\METEOSKY.AVI Object is locked skipped
E:\data\movies\MK8.AVI Object is locked skipped
E:\data\movies\MKUP.AVI Object is locked skipped
E:\data\movies\MONITOR.AVI Object is locked skipped
E:\data\movies\MOVIECAM.LGP Object is locked skipped
E:\data\movies\MTCRL.AVI Object is locked skipped
E:\data\movies\MTNVL.AVI Object is locked skipped
E:\data\movies\MTNVL2.AVI Object is locked skipped
E:\data\movies\NIVLSFS.AVI Object is locked skipped
E:\data\movies\NORTHMK.AVI Object is locked skipped
E:\data\movies\NRCRL.AVI Object is locked skipped
E:\data\movies\NRCRL_B.AVI Object is locked skipped
E:\data\movies\NVLMK.AVI Object is locked skipped
E:\data\movies\ONTRAIN.AVI Object is locked skipped
E:\data\movies\OPENING.AVI Object is locked skipped
E:\data\movies\PARASHOT.AVI Object is locked skipped
E:\data\movies\PHOENIX.AVI Object is locked skipped
E:\data\movies\PLREXP.AVI Object is locked skipped
E:\data\movies\rckethit0.avi Object is locked skipped
E:\data\movies\rckethit1.avi Object is locked skipped
E:\data\movies\RCKETOFF.AVI Object is locked skipped
E:\data\movies\RCKTFAIL.AVI Object is locked skipped
E:\data\movies\SETOGAKE.AVI Object is locked skipped
E:\data\movies\SMK.AVI Object is locked skipped
E:\data\movies\SOUTHMK.AVI Object is locked skipped
E:\data\movies\SQLOGO.AVI Object is locked skipped
E:\data\movies\U_ROPEGO.AVI Object is locked skipped
E:\data\movies\U_ROPEIN.AVI Object is locked skipped
E:\data\movies\WEAPON0.AVI Object is locked skipped
E:\data\movies\WEAPON1.AVI Object is locked skipped
E:\data\movies\WEAPON2.AVI Object is locked skipped
E:\data\movies\WEAPON3.AVI Object is locked skipped
E:\data\movies\WEAPON4.AVI Object is locked skipped
E:\data\movies\WEAPON5.AVI Object is locked skipped
E:\data\movies\WH2E2.AVI Object is locked skipped
E:\data\movies\WHITE2.AVI Object is locked skipped
E:\data\movies\ZMIND01.AVI Object is locked skipped
E:\data\movies\ZMIND02.AVI Object is locked skipped
E:\data\movies\ZMIND03.AVI Object is locked skipped
E:\data\music\heart.wav Object is locked skipped
E:\data\music\music.idx Object is locked skipped
E:\data\music\sato.wav Object is locked skipped
E:\data\music\sensui.wav Object is locked skipped
E:\data\music\wind.wav Object is locked skipped
E:\data\sound\audio.dat Object is locked skipped
E:\data\sound\audio.fmt Object is locked skipped
E:\data\wm\WM0.BOT Object is locked skipped
E:\data\wm\WM0.MAP Object is locked skipped
E:\data\wm\WM2.BOT Object is locked skipped
E:\data\wm\WM2.MAP Object is locked skipped
E:\data\wm\WM3.BOT Object is locked skipped
E:\data\wm\WM3.MAP Object is locked skipped
E:\data\wm\world_us.lgp Object is locked skipped
E:\docs\hints\2301.html Object is locked skipped
E:\docs\hints\7777 Fever.htm Object is locked skipped
E:\docs\hints\Accessory List.htm Object is locked skipped
E:\docs\hints\Armor List.htm Object is locked skipped
E:\docs\hints\Battle Square.htm Object is locked skipped
E:\docs\hints\Chocobo Square.htm Object is locked skipped
E:\docs\hints\chocobo.html Object is locked skipped
E:\docs\hints\date.htm Object is locked skipped
E:\docs\hints\Enemy Skills.htm Object is locked skipped
E:\docs\hints\hints.html Object is locked skipped
E:\docs\hints\Kalm Traveler.htm Object is locked skipped
E:\docs\hints\Limits.htm Object is locked skipped
E:\docs\hints\lunarhrp.jpg Object is locked skipped
E:\docs\hints\mapoth.gif Object is locked skipped
E:\docs\hints\p1.htm Object is locked skipped
E:\docs\hints\p1_files\ffhr.gif Object is locked skipped
E:\docs\hints\p1_files\ffhrbig.gif Object is locked skipped
E:\docs\hints\p2.htm Object is locked skipped
E:\docs\hints\p2_files\boss.gif Object is locked skipped
E:\docs\hints\p2_files\ffhr.gif Object is locked skipped
E:\docs\hints\p2_files\ffhrbig.gif Object is locked skipped
E:\docs\hints\p2_files\items.gif Object is locked skipped
E:\docs\hints\p2_files\o.gif Object is locked skipped
E:\docs\hints\p2_files\s.gif Object is locked skipped
E:\docs\hints\p2_files\t.gif Object is locked skipped
E:\docs\hints\p2_files\x.gif Object is locked skipped
E:\docs\hints\p3.htm Object is locked skipped
E:\docs\hints\p3_files\boss.gif Object is locked skipped
E:\docs\hints\p3_files\ffhr.gif Object is locked skipped
E:\docs\hints\p3_files\items.gif Object is locked skipped
E:\docs\hints\p3_files\l.gif Object is locked skipped
E:\docs\hints\p3_files\o.gif Object is locked skipped
E:\docs\hints\p3_files\r.gif Object is locked skipped
E:\docs\hints\p3_files\s.gif Object is locked skipped
E:\docs\hints\p3_files\st.gif Object is locked skipped
E:\docs\hints\p3_files\x.gif Object is locked skipped
E:\docs\hints\p4.htm Object is locked skipped
E:\docs\hints\p4_files\boss.gif Object is locked skipped
E:\docs\hints\p4_files\d.gif Object is locked skipped
E:\docs\hints\p4_files\ffhr.gif Object is locked skipped
E:\docs\hints\p4_files\ffhrbig.gif Object is locked skipped
E:\docs\hints\p4_files\items.gif Object is locked skipped
E:\docs\hints\p4_files\l.gif Object is locked skipped
E:\docs\hints\p4_files\o.gif Object is locked skipped
E:\docs\hints\p4_files\r.gif Object is locked skipped
E:\docs\hints\p4_files\s.gif Object is locked skipped
E:\docs\hints\p4_files\t.gif Object is locked skipped
E:\docs\hints\p4_files\u.gif Object is locked skipped
E:\docs\hints\p4_files\x.gif Object is locked skipped
E:\docs\hints\p5.htm Object is locked skipped
E:\docs\hints\p5_files\boss.gif Object is locked skipped
E:\docs\hints\p5_files\bs0mp.gif Object is locked skipped
E:\docs\hints\p5_files\bsacc.gif Object is locked skipped
E:\docs\hints\p5_files\bsallmat.gif Object is locked skipped
E:\docs\hints\p5_files\bsarmor.gif Object is locked skipped
E:\docs\hints\p5_files\bsbmat.gif Object is locked skipped
E:\docs\hints\p5_files\bscure.gif Object is locked skipped
E:\docs\hints\p5_files\bsfrog.gif Object is locked skipped
E:\docs\hints\p5_files\bsgmat.gif Object is locked skipped
E:\docs\hints\p5_files\bshp.gif Object is locked skipped
E:\docs\hints\p5_files\bshpmp.gif Object is locked skipped
E:\docs\hints\p5_files\bsitem.gif Object is locked skipped
E:\docs\hints\p5_files\bsl7.gif Object is locked skipped
E:\docs\hints\p5_files\bslv10.gif Object is locked skipped
E:\docs\hints\p5_files\bslv5.gif Object is locked skipped
E:\docs\hints\p5_files\bsmini.gif Object is locked skipped
E:\docs\hints\p5_files\bsmp.gif Object is locked skipped
E:\docs\hints\p5_files\bspmat.gif Object is locked skipped
E:\docs\hints\p5_files\bspois.gif Object is locked skipped
E:\docs\hints\p5_files\bsrmat.gif Object is locked skipped
E:\docs\hints\p5_files\bsslow.gif Object is locked skipped
E:\docs\hints\p5_files\bssword.gif Object is locked skipped
E:\docs\hints\p5_files\bstime.gif Object is locked skipped
E:\docs\hints\p5_files\bsymat.gif Object is locked skipped
E:\docs\hints\p5_files\d.gif Object is locked skipped
E:\docs\hints\p5_files\ffhr.gif Object is locked skipped
E:\docs\hints\p5_files\ffhrbig.gif Object is locked skipped
E:\docs\hints\p5_files\ffhrsmal.gif Object is locked skipped
E:\docs\hints\p5_files\items.gif Object is locked skipped
E:\docs\hints\p5_files\l.gif Object is locked skipped
E:\docs\hints\p5_files\l1.gif Object is locked skipped
E:\docs\hints\p5_files\l2.gif Object is locked skipped
E:\docs\hints\p5_files\o.gif Object is locked skipped
E:\docs\hints\p5_files\r.gif Object is locked skipped
E:\docs\hints\p5_files\r1.gif Object is locked skipped
E:\docs\hints\p5_files\r2.gif Object is locked skipped
E:\docs\hints\p5_files\s.gif Object is locked skipped
E:\docs\hints\p5_files\sl.gif Object is locked skipped
E:\docs\hints\p5_files\st.gif Object is locked skipped
E:\docs\hints\p5_files\t.gif Object is locked skipped
E:\docs\hints\p5_files\u.gif Object is locked skipped
E:\docs\hints\p5_files\x.gif Object is locked skipped
E:\docs\hints\p6.htm Object is locked skipped
E:\docs\hints\p6_files\boss.gif Object is locked skipped
E:\docs\hints\p6_files\d.gif Object is locked skipped
E:\docs\hints\p6_files\ffhr.gif Object is locked skipped
E:\docs\hints\p6_files\ffhrbig.gif Object is locked skipped
E:\docs\hints\p6_files\ffhrsmal.gif Object is locked skipped
E:\docs\hints\p6_files\items.gif Object is locked skipped
E:\docs\hints\p6_files\l.gif Object is locked skipped
E:\docs\hints\p6_files\l1.gif Object is locked skipped
E:\docs\hints\p6_files\l2.gif Object is locked skipped
E:\docs\hints\p6_files\o.gif Object is locked skipped
E:\docs\hints\p6_files\r.gif Object is locked skipped
E:\docs\hints\p6_files\r1.gif Object is locked skipped
E:\docs\hints\p6_files\r2.gif Object is locked skipped
E:\docs\hints\p6_files\s.gif Object is locked skipped
E:\docs\hints\p6_files\sl.gif Object is locked skipped
E:\docs\hints\p6_files\st.gif Object is locked skipped
E:\docs\hints\p6_files\t.gif Object is locked skipped
E:\docs\hints\p6_files\u.gif Object is locked skipped
E:\docs\hints\p6_files\x.gif Object is locked skipped
E:\docs\hints\tiptrick.html Object is locked skipped
E:\docs\hints\Utai Subquest.htm Object is locked skipped
E:\docs\hints\Weapons.htm Object is locked skipped
E:\docs\hints\Welcome To My Chocobo Guide!!.htm Object is locked skipped
E:\docs\misc\FF7 PC manual.rtf Object is locked skipped
E:\docs\misc\FF7 ReadMe.txt Object is locked skipped
E:\docs\misc\SFMAN for AWE32,64 ReadMe.txt Object is locked skipped
E:\ff7.exe Object is locked skipped
E:\ff7.reg Object is locked skipped
E:\FF7Config.exe Object is locked skipped
E:\ff7input.cfg Object is locked skipped
E:\found.000\dir0000.chk\MountPointManagerRemoteDatabase Object is locked skipped
E:\readme.txt Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

==================
HijackThis Log:
==================
Logfile of HijackThis v1.99.1
Scan saved at 11:07:55 PM, on 7/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe
C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NortonAntiBot] "C:\Program Files\Symantec\Norton AntiBot\agent\bin\NortonAntiBot.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180721276437
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SymantecAntiBotAgent - Unknown owner - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABAgent.exe" SymantecAntiBotAgent (file missing)
O23 - Service: SymantecAntiBotWatcher - Symantec - C:\Program Files\Symantec\Norton AntiBot\agent\Bin\NABWatcher.exe

silver

Post #14July 18, 2007, 1:28 AM UTC

Hi radjap,

Kaspersky only flagged items which are in quarantine folders so we just have some finishing off to do:

We can now remove the tools and quarantined files using OTMoveIt's Clean Up function:

Double-click OTMoveIt to start the program
Close all other programs apart from OTMoveIt as this step will require a reboot
On the OTMoveIt main screen, press the CleanUp! button
Say Yes to the prompt and then allow the program to reboot your computer.

Also, open NOD32 and clean quarantined files.

Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like clean then press the Create button and once it's done press Close

Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up… and say Yes to the prompt
Press OK and Yes to confirm

At this stage I think your machine is now clean

here are some tips to help you keep it that way:

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs are set to automatically update daily.

You have good protection programs installed, however I recommend you also install antispyware software with real-time capabilities - this will protect you from a wider range of malware and also that it will protect you from system changes and spyware while you are working, not just removing malware after it has been installed. There are a range of paid-for and free packages available, a free one I can recommend is Windows Defender, available here:
http://www.microsoft.com/athome/security/s…re/default.mspx

You should consider installing a Personal Firewall program. Even if you are behind a NAT router, I recommend you use firewall software as it will improve the security of your computer by monitoring and controlling outbound connections to the internet as well as inbound. There are various free packages available, such as Sunbelt Personal Firewall and Zone Alarm:
http://www.sunbelt-software.com/Home-Home-…sonal-Firewall/
http://www.zonelabs.com/

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

Find out more about how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know that you have read this, and if there are any further issues.

radjap

Post #15July 18, 2007, 4:45 PM UTC

Nice… Couldn't ask for more. Thanks Silver, nice job…

I've read the articles and hopefully I can do these things. Keep up the excellent services you dutifully provide, I'm sure lots of people out there look up to what all of you are doing.

Much Respect, Rad

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Qwerty12.exe ? [Resolved]

✨ Ask AI

Ask AI