[Closed] Jambanmu.com And Flash.10.exe

When windows start, 2 error appears. " Windows cannot find C:\WINDOWS\system32\JambanMu.com.Make sure you typed the name correctly, and then try again" Another error which is Windows cannot find Flash.10.exe

I found that the folder option menu has dissapeared. Also cannot access regedit. It says regedit has been disabled by administrator.
So far my antivirus also cannot start. I dont know why.

I have scan my pc and below is the log of my scanning ;



Logfile of HijackThis v1.99.1
Scan saved at 8:59:08 PM, on 9/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe
D:\programfiles\webserver\bin\win32\matlabserver.exe
C:\Program Files\Ansys Inc\Shared Files\Licensing\intel\ansyslmd.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\mIRC\mirc.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\system32\JambanMu.com"
F3 - REG:win.ini: load=Flash.10.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6291957C-8CE9-4c90-BEFF-12D9E68CFF30} - C:\WINDOWS\iDonate.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKCU\..\Run: [P2kAutostart] E:\Modmymoto\Modding\Tools\Software\P2kCommanderV330\P2kAutostart.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5908A47C-F569-4B46-8B35-5FE2C63CC276} (PEAgent) - http://messenger.yahoo.com/GGBTRENDMICRO/cabinet/PEAgent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4ACC288-6EF0-4CAF-B487-FEF09C79B3AB}: NameServer = 160.0.226.202
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ANSYS FLEXlm license manager - Macrovision Corporation - C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - D:\programfiles\webserver\bin\win32\matlabserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

Hello bud3ng

My name is SNOWHITE and I will be helping you with your Malware problem.

PLEASE READ THIS POST COMPLETELY, IT MAY MAKE IT EASIER FOR YOU IF YOU COPY AND PASTE THIS POST INTO A NEW TEXT DOCUMENT OR PRINT IT FOR REFERENCE LATER

Please follow the steps below exactly in the order they are written:

Step #1

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Step #2

Please run this online scan:

Panda ActiveScan

• Once you are on the Panda site, click the Scan your PC button
• A new window will open…click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on Local Disks to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log

Step #3

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

In your next post please include the following reports:

• SDFix report
• Panda report
• dss scan reports main.txt and extra.txt

Let me know how the things went, also if your computer connected to home network.

Regards,

1.I have finished STEP 1 and this is the report using SDFix;

SDFix: Version 1.106

Run by [removed] on Fri 09/21/2007 at 10:09 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
——————




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ANSYS.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ANSYS.exe:*:Enabled:ANSYS.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ans_admin.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ans_admin.exe:*:Enabled:ans_admin.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970.exe:*:Enabled:ls970.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970_DP.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970_DP.exe:*:Enabled:ls970_DP.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lspost.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lspost.exe:*:Enabled:lspost.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lsprepostd.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lsprepostd.exe:*:Enabled:lsprepostd.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitest.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitest.exe:*:Enabled:mpitest.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitestmpich.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitestmpich.exe:*:Enabled:mpitestmpich.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\sxpost.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\sxpost.exe:*:Enabled:sxpost.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\tclsh.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\tclsh.exe:*:Enabled:tclsh.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\wish.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\wish.exe:*:Enabled:wish.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYS\\ANSYS.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYS\\ANSYS.exe:*:Enabled:ANSYS.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYSMPICH\\ANSYS.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYSMPICH\\ANSYS.exe:*:Enabled:ANSYS.exe"
"C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\tclsh.exe"="C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\tclsh.exe:*:Enabled:tclsh.exe"
"C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\wish.exe"="C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\wish.exe:*:Enabled:wish.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\catia\\Intel\\ac4catia.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\catia\\Intel\\ac4catia.exe:*:Enabled:ac4catia.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\para\\Intel\\ac4para.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\para\\Intel\\ac4para.exe:*:Enabled:ac4para.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\pro\\Intel\\ac4pro.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\pro\\Intel\\ac4pro.exe:*:Enabled:ac4pro.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\sat\\Intel\\ac4sat.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\sat\\Intel\\ac4sat.exe:*:Enabled:ac4sat.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug180\\Intel\\ansconug180.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug180\\Intel\\ansconug180.exe:*:Enabled:ansconug180.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug190\\Intel\\ansconug190.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug190\\Intel\\ansconug190.exe:*:Enabled:ansconug190.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug20\\Intel\\ansconug20.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug20\\Intel\\ansconug20.exe:*:Enabled:ansconug20.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ANSYS.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ANSYS.exe:*:Enabled:ANSYS.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ans_admin.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ans_admin.exe:*:Enabled:ans_admin.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970.exe:*:Enabled:ls970.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970_DP.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\ls970_DP.exe:*:Enabled:ls970_DP.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lspost.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lspost.exe:*:Enabled:lspost.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lsprepostd.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\lsprepostd.exe:*:Enabled:lsprepostd.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitest.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitest.exe:*:Enabled:mpitest.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitestmpich.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\mpitestmpich.exe:*:Enabled:mpitestmpich.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\sxpost.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\sxpost.exe:*:Enabled:sxpost.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\tclsh.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\tclsh.exe:*:Enabled:tclsh.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\wish.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\wish.exe:*:Enabled:wish.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYS\\ANSYS.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYS\\ANSYS.exe:*:Enabled:ANSYS.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYSMPICH\\ANSYS.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\bin\\Intel\\DANSYSMPICH\\ANSYS.exe:*:Enabled:ANSYS.exe"
"C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\tclsh.exe"="C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\tclsh.exe:*:Enabled:tclsh.exe"
"C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\wish.exe"="C:\\Program Files\\Ansys Inc\\v90\\CommonFiles\\TCL\\bin\\Intel\\wish.exe:*:Enabled:wish.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\catia\\Intel\\ac4catia.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\catia\\Intel\\ac4catia.exe:*:Enabled:ac4catia.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\para\\Intel\\ac4para.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\para\\Intel\\ac4para.exe:*:Enabled:ac4para.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\pro\\Intel\\ac4pro.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\pro\\Intel\\ac4pro.exe:*:Enabled:ac4pro.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\sat\\Intel\\ac4sat.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\sat\\Intel\\ac4sat.exe:*:Enabled:ac4sat.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug180\\Intel\\ansconug180.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug180\\Intel\\ansconug180.exe:*:Enabled:ansconug180.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug190\\Intel\\ansconug190.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug190\\Intel\\ansconug190.exe:*:Enabled:ansconug190.exe"
"C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug20\\Intel\\ansconug20.exe"="C:\\Program Files\\Ansys Inc\\v90\\ANSYS\\ac4\\bin\\ug20\\Intel\\ansconug20.exe:*:Enabled:ansconug20.exe"

Remaining Files:
—————


Files with Hidden Attributes:

C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll
C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\WINDOWS\SoftwareDistribution\Downloadf8a5d0d09e527fa35dec9e085d4b802\BIT15.tmp
C:\WINDOWS\SoftwareDistribution\Download\4cbc0c1da652794a86c37dbd177bef9d\BIT19.tmp
C:\WINDOWS\SoftwareDistribution\Download\4e28cc4378cd0807778e1b0917bd6312\BIT14.tmp
C:\WINDOWS\SoftwareDistribution\Download\52b72a8354f3c8a72b1aee0b2a11d368\BIT16.tmp
C:\WINDOWS\SoftwareDistribution\Download\a4a9ccd1806461c53ce89bdd6f4591bf\BIT18.tmp
C:\WINDOWS\SoftwareDistribution\Download\ab24052f4987d828c75b146887588d0c\BIT13.tmp
C:\WINDOWS\SoftwareDistribution\Download\c9cdbfcd49200c55d94bb81819c80f2b\BIT17.tmp

Finished!

2. I cant do step 2 because my college has enable download limiting. ActiveX that must be downloaded (8MB) is exceeded my college download limit which is only 2MB. So that i cant run activescan using Panda Activescan.


3. I finished step 3 which is using dss.exe and here are the reports


Main.txt

Deckard's System Scanner v20070905.67
Run by [removed] on 2007-09-21 22:29:00
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
15: 2007-09-22 05:29:04 UTC - RP110 - Deckard's System Scanner Restore Point
14: 2007-09-21 13:19:48 UTC - RP109 - System Checkpoint
13: 2007-09-20 12:39:59 UTC - RP108 - System Checkpoint
12: 2007-09-19 09:46:15 UTC - RP107 - System Checkpoint
11: 2007-09-18 07:35:57 UTC - RP106 - System Checkpoint


– First Restore Point –
1: 2007-09-12 13:37:50 UTC - RP96 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

System Drive C: has 0.2 GiB (less than 15%) free.


– HijackThis (run as akira.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 10:29:27 PM, on 9/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe
D:\programfiles\webserver\bin\win32\matlabserver.exe
C:\Program Files\Ansys Inc\Shared Files\Licensing\intel\ansyslmd.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\akira\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\akira.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6291957C-8CE9-4c90-BEFF-12D9E68CFF30} - C:\WINDOWS\iDonate.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKCU\..\Run: [P2kAutostart] E:\Modmymoto\Modding\Tools\Software\P2kCommanderV330\P2kAutostart.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5908A47C-F569-4B46-8B35-5FE2C63CC276} (PEAgent) - http://messenger.yahoo.com/GGBTRENDMICRO/cabinet/PEAgent.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4ACC288-6EF0-4CAF-B487-FEF09C79B3AB}: NameServer = 160.0.226.202
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ANSYS FLEXlm license manager - Macrovision Corporation - C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - D:\programfiles\webserver\bin\win32\matlabserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe


– File Associations ———————————————————–

.bat - batfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,71
.com - comfile - DefaultIcon - %SystemRoot%\System32\shell32.dll,0
.inf - inffile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69
.ini - inifile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69
.scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\notepad.exe" "%1"
.txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,70
.vbs - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,70
.vbs - txtfile - shell\open\command - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - txtfile - shell\edit\command - unable to read value


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R2 windrvNT - c:\windows\system32\windrvnt.sys
R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys

Daft Report

DAFT Log saved on 2007-09-22 01:49:56
———————————————————————–
.scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\notepad.exe" "%1"

Combofix Log

ComboFix 07-09-21.2 - "akira" 2007-09-22 2:10:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.643 [GMT -7:00]
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-08-22 to 2007-09-22 )))))))))))))))))))))))))))))))
.

2007-09-22 00:24 d——– C:\DOCUME~1\akira\APPLIC~1\Lavasoft
2007-09-22 00:22 d——– C:\Program Files\Lavasoft
2007-09-21 22:28 d——– C:\Deckard
2007-09-21 22:27 d——– C:\WINDOWS\system32\ActiveScan
2007-09-21 22:09 d——– C:\WINDOWS\ERUNT
2007-09-21 21:17 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-19 23:54 91,136 –a—— C:\WINDOWS\BC5RMV.EXE
2007-09-19 23:54 d–h—– C:\WINDOWS\PIF
2007-09-19 23:53 d——– C:\BC5
2007-09-15 05:28 d——– C:\Program Files\Cheating-Death
2007-09-11 23:28 d——– C:\DOCUME~1\akira\WINDOWS
2007-09-10 03:15 41,324 –a—— C:\WINDOWS\system32\winio.sys
2007-09-10 03:15 d——– C:\DOCUME~1\akira\APPLIC~1\MathWorks
2007-09-08 22:17 d——– C:\Program Files\Your Freedom
2007-09-08 22:07 53,248 –a—— C:\WINDOWS\iDonate.dll
2007-09-07 05:55 d——– C:\Temp
2007-09-07 05:54 d——– C:\Program Files\ImTOO
2007-09-02 22:02 286,720 –a—— C:\WINDOWS\iun506.exe
2007-09-02 22:02 d——– C:\Program Files\WWE-Script
2007-08-26 14:58 d——– C:\Program Files\HLSW
2007-08-25 00:43 65,536 –a—— C:\WINDOWS\system32\a1.dll
2007-08-25 00:43 520,192 –a—— C:\WINDOWS\system32\wscma2u.exe
2007-08-25 00:43 278,528 –a—— C:\WINDOWS\system32\ammpp.dll
2007-08-25 00:43 193,536 –a—— C:\WINDOWS\system32\atomid.exe
2007-08-25 00:43 d——– C:\Program Files\AnMing
2007-08-25 00:36 368,912 –a—— C:\WINDOWS\system32\vbar332.dll
2007-08-25 00:36 d——– C:\Program Files\Coding Workshop
2007-08-25 00:33 d——– C:\Program Files\1stbenison
2007-08-25 00:17 d——– C:\Program Files\LitexMedia

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-16 07:29 ——— d——– C:\Program Files\Common Files\Autodesk Shared
2007-09-16 07:29 ——— d——– C:\Program Files\AnswerWorks 4.0
2007-09-12 02:34 ——— d——– C:\DOCUME~1\akira\APPLIC~1\Ansys
2007-09-12 00:07 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-11 23:46 ——— d——– C:\Program Files\Ansys Inc
2007-09-02 18:55 ——— d——– C:\Program Files\Yahoo!
2007-08-31 02:06 ——— d——– C:\Program Files\LeaderGL_FlexEditor
2007-08-17 23:06 98304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2007-08-17 23:00 611064 –a—— C:\WINDOWS\system32\drivers\sptd.sys
2007-08-16 17:16 ——— d——– C:\Program Files\Easy Icon Maker
2007-08-16 16:53 ——— d——– C:\Program Files\Bee Icons
2007-08-16 16:20 ——— d——– C:\Program Files\Google
2007-08-16 16:15 ——— d——– C:\Program Files\vtplus
2007-08-10 19:52 ——— d——– C:\Program Files\DivX
2007-08-09 20:41 ——— d——– C:\Program Files\FlvAmp FLV Player
2007-08-02 22:56 512096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2007-08-02 22:56 298104 –a—— C:\WINDOWS\system32\imon.dll
2007-08-02 22:56 15424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2007-08-02 02:08 ——— d——– C:\DOCUME~1\akira\APPLIC~1\Autodesk
2007-08-02 02:05 ——— d——– C:\Program Files\Autodesk
2007-08-02 02:05 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
2007-07-31 01:31 ——— d——– C:\Program Files\@Last Software
2007-07-28 01:59 ——— d——– C:\DOCUME~1\akira\APPLIC~1\Google
2007-07-13 18:26 35363 –a—— C:\WINDOWS\system32\windrvNT.sys
2007-07-10 13:15 53248 –a—— C:\WINDOWS\system32\suppdll.dll
2007-07-08 15:50 2320640 –a—— C:\WINDOWS\system32\TUKernel.exe
2007-07-07 16:57 50688 –a—— C:\WINDOWS\system32\wbhelp2.dll
2007-07-05 20:34 499712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-07-05 20:34 348160 –a—— C:\WINDOWS\system32\msvcr71.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-10-17 11:45 C:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 12:00]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 14:22]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-08-02 22:56]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P2kAutostart"="E:\Modmymoto\Modding\Tools\Software\P2kCommanderV330\P2kAutostart.exe" [2005-11-01 19:56]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\ypager.exe" [2005-08-05 20:35]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\SC_Reader.exe [2007-07-13 18:49:46]

R2 ANSYS FLEXlm license manager;ANSYS FLEXlm license manager;C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R2 windrvNT;windrvNT;\??\C:\WINDOWS\system32\windrvNT.sys
S3 NuVision;Hauppauge WinTV USB Pro (PAL B/G,D/K);C:\WINDOWS\system32\DRIVERS\NUVision.sys
S3 WINIO;WINIO;\??\C:\WINDOWS\system32\winio.sys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7a4ba9e-2b72-11dc-b6df-b36f772e0018}]
AutoRun\command- G:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2007-09-22 09:00:45 C:\WINDOWS\Tasks\1-Click Maintenance.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-22 02:10:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
P2kAutostart = E:\Modmymoto\Modding\Tools\Software\P2kCommanderV330\P2kAutostart.exe?0???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-22 2:11:16
C:\ComboFix-quarantined-files.txt … 2007-09-22 02:11
C:\ComboFix2.txt … 2007-07-17 16:23
.
— E O F —

And this is the Hijackthis Log

Logfile of HijackThis v1.99.1
Scan saved at 2:12:42 AM, on 9/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe
D:\programfiles\webserver\bin\win32\matlabserver.exe
C:\Program Files\Ansys Inc\Shared Files\Licensing\intel\ansyslmd.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\WINDOWS\system32\wscntfy.exe
E:\Program Files\mIRC\mirc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6291957C-8CE9-4c90-BEFF-12D9E68CFF30} - C:\WINDOWS\iDonate.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [P2kAutostart] E:\Modmymoto\Modding\Tools\Software\P2kCommanderV330\P2kAutostart.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5908A47C-F569-4B46-8B35-5FE2C63CC276} (PEAgent) - http://messenger.yahoo.com/GGBTRENDMICRO/cabinet/PEAgent.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4ACC288-6EF0-4CAF-B487-FEF09C79B3AB}: NameServer = 160.0.226.202
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ANSYS FLEXlm license manager - Macrovision Corporation - C:\PROGRA~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - D:\programfiles\webserver\bin\win32\matlabserver.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

For your info, i cant update my NOD32 antivirus