C:\rapport.txt

SmitFraudFix v2.217 Scan done at 13:12:24.04, Wed 08/29/2007 Run from C:\Documents and Settings\^Kevin^\Desktop\ANTIVIRUS\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode ปปปปปปปปปปปปปปปปปปปปปปปป Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Trackerx90\Anti Removable Disk Virus (ARDV) by Trackerx90\ardv32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cmd.exe ปปปปปปปปปปปปปปปปปปปปปปปป hosts ปปปปปปปปปปปปปปปปปปปปปปปป C:\ ปปปปปปปปปปปปปปปปปปปปปปปป C:\WINDOWS ปปปปปปปปปปปปปปปปปปปปปปปป C:\WINDOWS\system ปปปปปปปปปปปปปปปปปปปปปปปป C:\WINDOWS\Web ปปปปปปปปปปปปปปปปปปปปปปปป C:\WINDOWS\system32 C:\WINDOWS\system32\hadjajr.ini FOUND ! C:\WINDOWS\system32\vtr???.dll FOUND ! ปปปปปปปปปปปปปปปปปปปปปปปป C:\Documents and Settings\^Kevin^ ปปปปปปปปปปปปปปปปปปปปปปปป C:\Documents and Settings\^Kevin^\Application Data ปปปปปปปปปปปปปปปปปปปปปปปป Start Menu ปปปปปปปปปปปปปปปปปปปปปปปป C:\DOCUME~1\KEVI~1\FAVORI~1 ปปปปปปปปปปปปปปปปปปปปปปปป Desktop ปปปปปปปปปปปปปปปปปปปปปปปป C:\Program Files ปปปปปปปปปปปปปปปปปปปปปปปป Corrupted keys ปปปปปปปปปปปปปปปปปปปปปปปป Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" ปปปปปปปปปปปปปปปปปปปปปปปป Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll ปปปปปปปปปปปปปปปปปปปปปปปป AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="C:\\WINDOWS\\system32\\hadjajr.ini" ปปปปปปปปปปปปปปปปปปปปปปปป Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" ปปปปปปปปปปปปปปปปปปปปปปปป Rustock ปปปปปปปปปปปปปปปปปปปปปปปป DNS Description: Marvell Yukon 88E8038 PCI-E Fast Ethernet Controller - Packet Scheduler Miniport DNS Server Search Order: 192.168.1.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{2BBB9DCA-31EB-47B5-ADE2-2E50837147FB}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{2BBB9DCA-31EB-47B5-ADE2-2E50837147FB}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{2BBB9DCA-31EB-47B5-ADE2-2E50837147FB}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 ปปปปปปปปปปปปปปปปปปปปปปปป Scanning for wininet.dll infection ปปปปปปปปปปปปปปปปปปปปปปปป End Windows cannot find'C:\WINDOWS\system32\printer.exe'. Make sure you typed the name correctly,and then try again. To search for a file,clicl the start botton,and then click search HELP ME PLEASE THANK YOU SO MUCH

Hi and welcome to the forums. I'm Markka and I will be helping you with your malware issues. I'll check your HijackThis log. Right now I'm MRU Undergrad, everything that I post to you must be checked by teachers of Malware Removal University. Please be patient.

Hello

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.
_________________________

• Click here to download HijackThis and save it to your desktop.
• Double-click on HJTInstall.exe to run it.
• HJTInstall.exe will install HijackThis to here C:\Program Files\Trend Micro\HijackThis
• Click install
• HJTInstall.exe will create an icon to your desktop.
• When the installation is ready, it will start HijackThis.
• When HijackThis is opened, click Do a system scan and save a logfile.
• Post the HijackThis log here.
• Do not fix anything with HijackThis, until I tell to you!

__________________

Post:
- A fresh HijackThis log
- Contents of C:\Rapport.txt

Hello

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

SDFix: Version 1.101 Run by [removed] on Sat 09/01/2007 at 12:25 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: —————— Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\FlashGet\\FlashGet.exe"="C:\\Program Files\\FlashGet\\FlashGet.exe:*:Enabled:Flashget" "C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"="C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe:*:Enabled:Veoh Client" "D:\\Program Files\\Asiasoft\\CABAL Online\\launcher\\update\\ESTdnheadless.exe"="D:\\Program Files\\Asiasoft\\CABAL Online\\launcher\\update\\ESTdnheadless.exe:*:Enabled:EST! download engine" "C:\\Program Files\\DiskTrix\\UltimateDefrag\\UDefrag.exe"="C:\\Program Files\\DiskTrix\\UltimateDefrag\\UDefrag.exe:*:Enabled:UltimateDefrag V1.54" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "E:\\Dot A\\Warcraft III.exe"="E:\\Dot A\\Warcraft III.exe:*:Enabled:Warcraft III" "%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Orbitdownloader\\orbitdm.exe"="C:\\Program Files\\Orbitdownloader\\orbitdm.exe:*:Enabled:Orbit" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019" Remaining Files: ————— Files with Hidden Attributes: C:\Program Files\Picasa2\setup.exe Finished

SmitFraudFix v2.217 Scan done at 2:33:08.85, Fri 08/31/2007 Run from C:\Documents and Settings\^Kevin^\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode ปปปปปปปปปปปปปปปปปปปปปปปป SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll ปปปปปปปปปปปปปปปปปปปปปปปป Killing process ปปปปปปปปปปปปปปปปปปปปปปปป hosts ปปปปปปปปปปปปปปปปปปปปปปปป Generic Renos Fix GenericRenosFix by S!Ri ปปปปปปปปปปปปปปปปปปปปปปปป Deleting infected files C:\WINDOWS\system32\vtr???.dll Deleted ปปปปปปปปปปปปปปปปปปปปปปปป DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{2BBB9DCA-31EB-47B5-ADE2-2E50837147FB}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{2BBB9DCA-31EB-47B5-ADE2-2E50837147FB}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{2BBB9DCA-31EB-47B5-ADE2-2E50837147FB}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 ปปปปปปปปปปปปปปปปปปปปปปปป Deleting Temp Files ปปปปปปปปปปปปปปปปปปปปปปปป Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" ปปปปปปปปปปปปปปปปปปปปปปปป Registry Cleaning Registry Cleaning done. ปปปปปปปปปปปปปปปปปปปปปปปป SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll ปปปปปปปปปปปปปปปปปปปปปปปป Reboot C:\WINDOWS\system32\hadjajr.ini Please, Reboot and Run SmitfraudFix option 2 once again. ปปปปปปปปปปปปปปปปปปปปปปปป End I cannot shut down my computer it still restarts everytime.

Hello

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install AVG Anti-Spyware by double clicking the installer.
• Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
• On the main screen under Your Computer's security.
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
  • Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
________________

Create a new folder here called HJT

C:\HJT

And move HijackThis.exe into that HJT folder.
______________

First we'll need to backup registry:

Start -> Run -> regedit -> ok. Then File -> Export. Give it a name and press Save.

Save text below as fix.reg on Notepad (save it as all files (*.*)) on Desktop

REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\winav.exe"=-

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\winav.exe"=-

It should look like this -> [external image: Posted Image]

Doubleclick fix.reg, press Yes and ok.

(In case you are unsure how to create a reg file, take a look here with screenshots.)
______________

Open HijackThis, Click Do a system scan only, checkmark these. Then close all other windows except HijackThis and press fix checked.

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [protect_autorun] C:\DOCUME~1\^^KEVI~1\LOCALS~1\Temp\Rar$EX00.875\CPE17AntiAutorun0750.exe /start
O20 - AppInit_DLLs: C:\WINDOWS\system32\hadjajr.ini
____________________

Make your hidden files visible:

• Click start
• Click my computer
• Select the Tools menu and click Folder Options.
• After the new window appears select the View tab.
• Put a checkmark in the checkbox labeled Display the contents of system folders.
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
• Remove the checkmark from the checkbox labeled Hide protected operating system files.
• Press the Apply button and then the OK button and shutdown My Computer.

_______________________

Please download ATF-cleaner and save it to your desktop.

• Double-click ATF-Cleaner.exe to run the program.
  
• Under Main choose: Select All
  
• Click the Empty Selected button.
  
  If you use Firefox browser:
  
  
• Click Firefox at the top and choose: Select All
  
• Click the Empty Selected button.
  
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
  If you use Opera browser:
  
  
• Click Opera at the top and choose: Select All
  
• Click the Empty Selected button.
  
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
• Click Exit on the Main menu to close the program.

_____________________

Please then reboot your computer in Safe Mode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

__________________

Delete this file: (Using Windows Explorer; Windows key + E)

C:\WINDOWS\system32\hadjajr.ini
__________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    [external image: Posted Image]
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.
______________________

Post:
- A fresh HijackThis log
- AVG Anti-Spyware's report

——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 1:03:52 4/9/2550 + Scan result: Nothing found. ::Report end

Hello

Kaspersky online scanner works only with Internet Explorer!

Please run an online scanner with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
  
• Once the scanner is installed and the definitions downloaded, click Next.
  
• Now click on Scan Settings
  
• In the scan settings make sure that the following are selected:
  
  o Scan using the following Anti-Virus database:
  
  + Extended (If available otherwise Standard)
  
  o Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
  
  
• Click OK
  
• Now under select a target to scan select My Computer
  
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  
• Now click on the Save as Text button
  
• Save the file to your desktop.
  
• Copy and paste that information in your next post.

__________________

Post:
- A fresh HijackThis log
- Kaspersky's report

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Wednesday, September 05, 2007 12:30:04 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 4/09/2007 Kaspersky Anti-Virus database records: 403900 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 38981 Number of viruses found: 8 Number of infected objects: 15 Number of suspicious objects: 1 Duration of the scan process: 00:43:10 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\AntiSpyInfo\hadjajr.ini.q_8041800_q Infected: Backdoor.Win32.Small.rb skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\^^Kevin^^\Cookies\index.dat Object is locked skipped C:\Documents and Settings\^^Kevin^^\Desktop\ANTIVIRUS\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\^^Kevin^^\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_3A58_6C9D_586C_59A1\dfsr.db Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_3A58_6C9D_586C_59A1\fsr.log Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_3A58_6C9D_586C_59A1\fsrtmp.log Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_3A58_6C9D_586C_59A1\tmp.edb Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\real\members.stg Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\shadow\members.stg Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\History\History.IE5\MSHist012007090420070905\index.dat Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temp\BCG782.tmp Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temp\~DF59EE.tmp Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temp\~DF59FB.tmp Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temp\~DFAA74.tmp Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temp\~DFAA84.tmp Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temp\~DFCDF7.tmp Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temp\~DFD33F.tmp Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\^^Kevin^^\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\^^Kevin^^\NTUSER.DAT Object is locked skipped C:\Documents and Settings\^^Kevin^^\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Ahead\Lib\NEROINST.DB Object is locked skipped C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped C:\Program Files\ESET\infected\30WJU3CA.NQF Infected: not-virus:Hoax.Win32.Renos.hv skipped C:\Program Files\ESET\infected\DVQHHOAA.NQF/data.rar/keygen.exe Infected: Trojan-Dropper.Win32.Small.ayg skipped C:\Program Files\ESET\infected\DVQHHOAA.NQF/data.rar/crack.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\Program Files\ESET\infected\DVQHHOAA.NQF/data.rar/serial.exe Infected: Trojan.Win32.Dialer.qn skipped C:\Program Files\ESET\infected\DVQHHOAA.NQF/data.rar/install.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\Program Files\ESET\infected\DVQHHOAA.NQF/data.rar Infected: Trojan-Downloader.Win32.Small.eqn skipped C:\Program Files\ESET\infected\DVQHHOAA.NQF RarSFX: infected - 5 skipped C:\Program Files\ESET\infected\DVQHHOAA.NQF PE-Crypt.XorPE: infected - 5 skipped C:\Program Files\ESET\infected\I2BKAQDA.NQF Infected: not-virus:Hoax.Win32.Renos.hv skipped C:\Program Files\ESET\infected\JJFN3MBA.NQF Infected: not-virus:Hoax.Win32.Renos.hv skipped C:\Program Files\ESET\infected\LTF4X4DA.NQF Infected: not-virus:Hoax.Win32.Renos.hv skipped C:\Program Files\ESET\infected\QK2TXVBA.NQF Infected: not-virus:Hoax.Win32.Renos.hv skipped C:\Program Files\ESET\infected\WTE5TTBA.NQF Suspicious: Packed.Win32.Morphine.a skipped C:\Program Files\ESET\logs\virlog.dat Object is locked skipped C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{A56D7A30-5AFD-4801-9182-067A9DB969DE}\RP9\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed.

Hello

Delete this file:

C:\Documents and Settings\All Users\Application Data\AntiSpyInfo\hadjajr.ini.q_8041800_q

______________

Click the NOD32 icon in the taskbar, then highlight nod32 system tools to expand it. Select quarantine by clicking on it.
Then delete the items in quarantine one at a time by right clicking them, then choosing "delete" from the context menu.
_______________

Disable system restore:

• Right click on my computer icon
• Choose properties
• Click on system restore tab
• Select Turn off System Restore
• Click apply and click OK
• Reboot!

Enable system restore:

• Right click on my computer icon
• Choose properties
• Click on system restore tab
• un-check Turn off System Restore
• Click apply and click OK
• Reboot!

______________

Re-run with Kaspersky online scanner!


Post:
- A fresh HijackThis log
- Kaspersky's report