Spyware / Malware / Virus Removal

[Resolved] Please Help~

24 min read

Looking for the outcome? Ask AI

chocokoko Topic Starter

Post #1February 28, 2008, 4:27 PM UTC

http://forums.whatthetech.com/Invalid_synt…tml&hl;=pos1

I had the same problem and followed your instruction. What do I do now? is my problem fixed ?
Thanks in advance.

ComboFix 08-02-25.3 - HingWah 2008-02-28 10:36:15.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.[removed].18.300 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\Documents and Settings\All Users\Application Data\salesmonitor
C:\Documents and Settings\HingWah\Application Data\.rdr.ini
C:\Documents and Settings\HingWah\Application Data\APPATC~1
C:\Documents and Settings\HingWah\Application Data\DriveCleaner Freeware
C:\Documents and Settings\HingWah\Application Data\DriveCleaner Freeware\Logs\update.log
C:\Documents and Settings\HingWah\Application Data\ICROSO~1.NET
C:\Documents and Settings\HingWah\Application Data\MBOLS~1
C:\Documents and Settings\HingWah\Application Data\SpyGuardPro
C:\Documents and Settings\HingWah\Application Data\SpyGuardPro\Logs\threats.log
C:\Documents and Settings\HingWah\Application Data\SpyGuardPro\Logs\update.log
C:\Documents and Settings\HingWah\Application Data\SSTEM~1
C:\Documents and Settings\HingWah\Application Data\tmp10.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp118.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp11D.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp143.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp144.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp167.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp16C.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp1A5.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp1C.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp1C1.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp1DB1.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp21EE.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp245.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp27.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp28.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp36.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp377.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp4F.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp50.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp51.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp5B6.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp5D.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp63.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp6A7.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp70.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp72.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp7A.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp82.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmp86.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmpBA8.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmpC75.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmpE.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmpEF8.tmp.exe
C:\Documents and Settings\HingWah\Application Data\tmpF.tmp.exe
C:\Documents and Settings\HingWah\Application Data\WinTouch
C:\Documents and Settings\HingWah\Application Data\WinTouch\wintouch.cfg
C:\Documents and Settings\HingWah\err.log
C:\Documents and Settings\HingWah\My Documents\CURITY~1
C:\Documents and Settings\HingWah\My Documents\ECURIT~1
C:\Documents and Settings\HingWah\My Documents\MCROSO~1.NET
C:\Documents and Settings\HingWah\My Documents\STEM~1
C:\Documents and Settings\LocalService\Application Data\.rdr.ini
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\LocalService\Desktop\searchus.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\n.ini
C:\Documents and Settings\NetworkService\Desktop\searchus.exe
C:\New Folder\[星野?一]官能實驗\_desktop.ini
C:\Program Files\Common Files\SpyGuardPro
C:\Program Files\Common Files\SpyGuardPro\bm.exe
C:\Program Files\Common Files\SpyGuardPro\ugac.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\Internet Explorer\promyfsywuewu.html
C:\Program Files\livabigas89104.dll
C:\Program Files\mbols~1
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Program Files\SpyGuardPro
C:\Program Files\SpyGuardPro\Activate.exe
C:\Program Files\SpyGuardPro\al.dat
C:\Program Files\SpyGuardPro\Config\pgs.xml
C:\Program Files\SpyGuardPro\Dat\Activate.dat
C:\Program Files\SpyGuardPro\Dat\BkSites.dat
C:\Program Files\SpyGuardPro\Dat\bnlink.dat
C:\Program Files\SpyGuardPro\Dat\cd.dat
C:\Program Files\SpyGuardPro\Dat\incmp.dat
C:\Program Files\SpyGuardPro\Dat\index.dat
C:\Program Files\SpyGuardPro\Dat\pv.dat
C:\Program Files\SpyGuardPro\dhlp.dll
C:\Program Files\SpyGuardPro\Engines\AWBase\database\enemies.dat
C:\Program Files\SpyGuardPro\Engines\AWBase\vbpv.dat
C:\Program Files\SpyGuardPro\Engines\PGBase\vbpv.dat
C:\Program Files\SpyGuardPro\Engines\plugins\BORLNDMM.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANADWR.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANBCDR.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANDLDR.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANDOS1.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANEMUL.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANFUNC.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANKRNL.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANMCR1.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANOTHR.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANSCR.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANTOOL.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANTROJ.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\SCANWIN1.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UNACPU.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UNADBX.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\unamscan.dll
C:\Program Files\SpyGuardPro\Engines\plugins\UNMIME.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UNPACK.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UNPACKS.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UNPACKS2.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UNPEPACK.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UpDate\UA27601.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UpDate\UA27602.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UpDate\UA27603.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UpDate\UA27604.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\UpDate\UADAILY.DLL
C:\Program Files\SpyGuardPro\Engines\plugins\vbpv.dat
C:\Program Files\SpyGuardPro\FWSettings.bin
C:\Program Files\SpyGuardPro\Graphics\cross.gif
C:\Program Files\SpyGuardPro\Graphics\ga6p.gif
C:\Program Files\SpyGuardPro\Graphics\kb.url
C:\Program Files\SpyGuardPro\Graphics\main.ico
C:\Program Files\SpyGuardPro\Graphics\mini.ico
C:\Program Files\SpyGuardPro\Graphics\Online.url
C:\Program Files\SpyGuardPro\Graphics\rm.url
C:\Program Files\SpyGuardPro\Graphics\support.ico
C:\Program Files\SpyGuardPro\Graphics\Support.url
C:\Program Files\SpyGuardPro\Graphics\uninstall.ico
C:\Program Files\SpyGuardPro\history.db
C:\Program Files\SpyGuardPro\LA\lapv.dat
C:\Program Files\SpyGuardPro\LA\License.rtf
C:\Program Files\SpyGuardPro\main.log
C:\Program Files\SpyGuardPro\pgs.exe
C:\Program Files\SpyGuardPro\ptask.exe
C:\Program Files\SpyGuardPro\reload.exe
C:\Program Files\SpyGuardPro\ResErrors.log
C:\Program Files\SpyGuardPro\scnkrnl.dll
C:\Program Files\SpyGuardPro\settings.ini
C:\Program Files\SpyGuardPro\sqlite3.dll
C:\Program Files\SpyGuardPro\sr.log
C:\Program Files\SpyGuardPro\Tools\pblock.dll
C:\Program Files\SpyGuardPro\Tools\sbiebho.dll
C:\Program Files\SpyGuardPro\unins000.dat
C:\Program Files\SpyGuardPro\unins000.exe
C:\Program Files\SpyGuardPro\Up\ASupdater.dat
C:\Program Files\SpyGuardPro\Up\gup.exe
C:\Program Files\SpyGuardPro\Up\PGupdater.dat
C:\Program Files\SpyGuardPro\Up\UBupdater.dat
C:\Program Files\SpyGuardPro\Up\up.dat
C:\Program Files\SpyGuardPro\Up\updater.dat
C:\Program Files\stem~1
C:\Program Files\web buying
C:\Program Files\web buying\v1.8.8\wbuninst.exe
C:\Program Files\web buying\v1.8.8\webbuying.exe
C:\Program Files\winpop
C:\Program Files\ystem3~1
C:\SpyGuardPro
C:\temp\0c2
C:\temp\0c2\tmpFF.log
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\brr
C:\temp\brr\tmpZTF.log
C:\Temp\isgTi19
C:\Temp\isgTi19\lPig.log
C:\Temp\tpBe12
C:\WINDOWS\cookies.ini
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\g4356cbvy63.exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\SGluZ1dhaA\
C:\WINDOWS\SGluZ1dhaA\\asappsrv.dll
C:\WINDOWS\SGluZ1dhaA\\command.exe
C:\WINDOWS\SGluZ1dhaA\\m35RtYx1uE.vbs
C:\WINDOWS\SGluZ1dhaA\command.exe
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\a1\tliamdll2.exe
C:\WINDOWS\system32\aocsejpf.dll
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\awtsr.exe
C:\WINDOWS\system32\axfryrxi.dll
C:\WINDOWS\system32\b02FdUe
C:\WINDOWS\system32\b06FdUe
C:\WINDOWS\system32\config\systemprofile\application data\.rdr.ini
C:\WINDOWS\system32\dnd440e210.dat
C:\WINDOWS\system32\gebcbbx.dll
C:\WINDOWS\system32\gwpiwjwj.dll
C:\WINDOWS\system32\ineWc01
C:\WINDOWS\system32\ineWc01\ineWc011065.exe
C:\WINDOWS\system32\k5
C:\WINDOWS\system32\k5\thgd2241dll.exe
C:\WINDOWS\system32\kbxmdgwu.dll
C:\WINDOWS\system32\kdqdvivv.dll
C:\WINDOWS\system32\kvpgizqc.dll
C:\WINDOWS\system32\kvpgizqc.dllbox
C:\WINDOWS\system32\ldfpgkht.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\lomjrtdl.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mtynqlve.dll
C:\WINDOWS\system32\n.ini
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
C:\WINDOWS\system32\nmxvelwn.dll
C:\WINDOWS\SYSTEM32\nremxrks.ini
C:\WINDOWS\system32\obylfocq.dll
C:\WINDOWS\system32\p9
C:\WINDOWS\system32\p9\liopud89104.exe
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\SYSTEM32\pqtss.bak1
C:\WINDOWS\SYSTEM32\pqtss.bak2
C:\WINDOWS\SYSTEM32\pqtss.ini
C:\WINDOWS\system32\qdkvrdlo.dll
C:\WINDOWS\system32\qnnsjlsh.dll
C:\WINDOWS\system32\rfmgd.dat
C:\WINDOWS\system32\rmypscvd.dll
C:\WINDOWS\system32\rwnhkobk.dll
C:\WINDOWS\system32\sahbbyhr.dll
C:\WINDOWS\system32\skrxmern.dll
C:\WINDOWS\system32\sstqp.dll
C:\WINDOWS\system32\sttlqbqh.dll
C:\WINDOWS\system32\theuiomp.dll
C:\WINDOWS\system32\tmp11E.tmp.dll
C:\WINDOWS\system32\tmp16C.tmp.dll
C:\WINDOWS\system32\tmp197.tmp.dll
C:\WINDOWS\system32\tmp21EE.tmp.dll
C:\WINDOWS\system32\tmp377.tmp.dll
C:\WINDOWS\system32\tmp50.tmp.dll
C:\WINDOWS\system32\tmp6A6.tmp.dll
C:\WINDOWS\system32\tmp72.tmp.dll
C:\WINDOWS\system32\tmp82.tmp.dll
C:\WINDOWS\system32\tmpC75.tmp.dll
C:\WINDOWS\system32\tyfcmihl.dll
C:\WINDOWS\system32\uovabjxm.dll
C:\WINDOWS\system32\uoymjamj.dll
C:\WINDOWS\system32\v6
C:\WINDOWS\system32\version69ie7fix.dll
C:\WINDOWS\system32\w11
C:\WINDOWS\system32\w11\hiba3133.exe
C:\WINDOWS\system32\win
C:\WINDOWS\system32\windows
C:\WINDOWS\system32\winnb58.dll
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\wnscpicomsv32.exe
C:\WINDOWS\system32\X1
C:\WINDOWS\system32\X1\kmhp83122.exe
C:\WINDOWS\system32\X11
C:\WINDOWS\system32\X3
C:\WINDOWS\system32\X7
C:\WINDOWS\system32\X9
C:\WINDOWS\system32\xuolqjdn.dll
C:\WINDOWS\system32\ystem~1
C:\WINDOWS\uni_eh44.exe
C:\WINDOWS\uninst1014.exe
C:\WINDOWS\uninst2.htm
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\unist1.htm
C:\WINDOWS\wr.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CMDSERVICE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_IPRIP
——-\LEGACY_NETWORK_MONITOR
——-\LEGACY_NET_AGENT
——-\LEGACY_WINDOWS_OVERLAY_COMPONENTS
——-\cmdService
——-\DomainService
——-\Iprip
——-\Network Monitor
——-\Windows Overlay Components

((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.

2008-02-25 15:54 . 2008-02-26 10:29 1,102,888 —hs—- C:\WINDOWS\SYSTEM32\voirefyh.ini
2008-02-22 17:45 . 2008-02-25 15:45 1,187,971 —hs—- C:\WINDOWS\SYSTEM32\ccmmixrm.ini
2008-02-22 16:47 . 2008-02-22 16:48 1,163,227 —hs—- C:\WINDOWS\SYSTEM32\pgwyakij.ini
2008-02-21 16:44 . 2008-02-22 16:45 1,164,392 —hs—- C:\WINDOWS\SYSTEM32\knokkegw.ini
2008-02-21 16:44 . 2008-02-27 19:54 63,850 –a—— C:\WINDOWS\BMd773d123.xml
2008-02-21 16:44 . 2008-02-28 09:29 22 –a—— C:\WINDOWS\pskt.ini
2008-02-21 15:47 . 2008-02-21 15:48 1,163,956 —hs—- C:\WINDOWS\SYSTEM32\skjcphsh.ini
2008-02-20 15:45 . 2008-02-21 15:46 1,241,401 —hs—- C:\WINDOWS\SYSTEM32\grkhydoa.ini
2008-02-20 12:45 . 2008-02-20 12:45 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-20 12:45 . 2008-02-20 12:45 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-19 15:42 . 2008-02-20 15:43 1,246,975 —hs—- C:\WINDOWS\SYSTEM32\hxrbpiln.ini
2008-02-19 14:42 . 2008-02-19 14:42 1,238,251 —hs—- C:\WINDOWS\SYSTEM32\unerwfie.ini
2008-02-18 14:39 . 2008-02-19 14:41 1,238,191 —hs—- C:\WINDOWS\SYSTEM32\jlglufvn.ini
2008-02-17 12:41 . 2008-02-18 13:36 1,248,887 —hs—- C:\WINDOWS\SYSTEM32\mvvaotnn.ini
2008-02-17 11:44 . 2008-02-17 11:44 1,248,707 —hs—- C:\WINDOWS\SYSTEM32\elxvrqsf.ini
2008-02-16 11:45 . 2008-02-16 11:45 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-16 11:43 . 2008-02-17 11:43 1,248,647 —hs—- C:\WINDOWS\SYSTEM32\hciuucdv.ini
2008-02-16 11:32 . 2008-02-16 12:42 d——– C:\Program Files\Fοnts
2008-02-16 11:32 . 2008-02-16 11:32 483,452 –a—— C:\Temp\chtOna0119.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-26 21:04 ——— d—–w C:\Documents and Settings\HingWah\Application Data\AdobeUM
2008-02-25 21:45 ——— d—–w C:\Program Files\FlashGet
2008-02-16 17:42 ——— d—–w C:\Program Files\Fοnts
2008-02-12 16:20 ——— d—–w C:\Program Files\MSN Messenger
2008-02-04 18:48 ——— d—–w C:\Program Files\MySpace
2008-02-04 18:37 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-02-04 18:30 ——— d—–w C:\Program Files\Uniblue
2008-02-04 18:30 ——— d—–w C:\Documents and Settings\HingWah\Application Data\Uniblue
2008-02-04 18:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-04 18:27 ——— d—–w C:\Program Files\Lavasoft
2008-02-04 18:27 ——— d—–w C:\Documents and Settings\HingWah\Application Data\Lavasoft
2008-01-09 01:39 ——— d—–w C:\Program Files\FLV Player
2007-12-04 22:35 74,532 —-a-w C:\WINDOWS\fccawu.dll
2006-01-19 16:11 784 —-a-w C:\Documents and Settings\HingWah\Application Data\mpauth.dat
2005-10-19 22:26 122 -c–a-w C:\Program Files\ppunistall.bat
2004-05-29 16:32 2,814 -csha-w C:\WINDOWS\agcpu.dat
2004-07-07 00:22 65,536 -csha-w C:\WINDOWS\n_yrlroq.dat
2004-01-09 06:55 4,402 -csha-w C:\WINDOWS\vpmpa.dat
2007-08-04 12:41 6,467 –sha-w C:\WINDOWS\SYSTEM32\mlnmp.bak1
2007-08-05 12:41 1,730,419 –sha-w C:\WINDOWS\SYSTEM32\mlnmp.bak2
2007-08-06 04:13 1,798,478 –sha-w C:\WINDOWS\SYSTEM32\mlnmp.ini2
2007-08-02 15:02 32,768 –sha-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012007080220070803\index.dat
2007-10-16 15:59 230,912 –sh–r C:\WINDOWS\ΑppPatch\svchost.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A85F6C9C-F658-F589-0C54-FF9A85FE4DC5}]
2007-10-16 10:58 60928 –a—— C:\WINDOWS\system32\vckhlxci.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 16:59 68856]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 09:18 1856544]
"Uniblue RegistryBooster2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 09:18 1856544]
"Uniblue SpeedUpMyPC"="C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" [2007-05-23 13:03 8631840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-12-14 15:12 180269]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-10-22 13:32 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\actMTF]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\C_1FAT]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c_2mon]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igm082]
igm082.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jpatD32]
jpatD32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MAINtpp]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnlm]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnkij]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
backup=C:\WINDOWS\pss\GStartup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^HingWah^Start Menu^Programs^Startup^Spykiller Pro v2.0.lnk]
backup=C:\WINDOWS\pss\Spykiller Pro v2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
–a—— 2003-08-29 03:59 122880 C:\WINDOWS\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
–a–c— 2002-11-22 14:49 188416 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04]
–a–c— 2002-11-22 14:48 348160 C:\WINDOWS\System32\hphmon04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD04]
–a–c— 2002-11-22 14:50 49152 C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
–a—— 2001-07-08 22:50 155648 C:\WINDOWS\system32\\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2003-04-24 16:58 4616192 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2005-10-22 13:32 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
–a–c— 2002-04-17 09:42 69632 C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2004-02-22 22:44 32881 C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2005-12-14 15:12 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updater]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
–a—— 2004-11-12 12:24 106557 C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winva32.exe]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"16918:TCP"= 16918:TCP:BitComet 16918 TCP
"16918:UDP"= 16918:UDP:BitComet 16918 UDP
"7681:TCP"= 7681:TCP:BitComet 7681 TCP
"7681:UDP"= 7681:UDP:BitComet 7681 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 dhlp;dhlp;C:\WINDOWS\system32\Drivers\dhlp.sys [2007-12-15 11:09]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.
Contents of the 'Scheduled Tasks' folder
"2008-02-28 16:05:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-02-12 16:04:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 15:03:59 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 17:14:58 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 11:01:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
.
**************************************************************************
.
Completion time: 2008-02-28 11:06:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-28 16:06:18
.
2008-02-13 08:03:44 — E O F —

Scotty

Post #2February 28, 2008, 7:41 PM UTC

Hi! Welcome to the WTT forums.
My name is Scotty. You have quite an infected system there. But trying to copy fixes you read elsewhere is not advisable.

Install HijackThis

Download HJTInstall.exe to your Desktop.
Doubleclick HJTInstall.exe to install it.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Copy/Paste the log to your next reply please.

Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

chocokoko

Post #3February 29, 2008, 4:47 PM UTC

Thanks for the reply!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:55:51 AM, on 2/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "https://webbroker10.tdwaterhouse.com/TD/Waterhouse/ie4x/logonForm.asp"); (C:\Documents and Settings\HINGWAH\Application Data\Mozilla\Profiles\default\6sj4dmyl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\HINGWAH\Application Data\Mozilla\Profiles\default\6sj4dmyl.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {A85F6C9C-F658-F589-0C54-FF9A85FE4DC5} - C:\WINDOWS\system32\vckhlxci.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue RegistryBooster2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantispyware.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O20 - Winlogon Notify: actMTF - C:\WINDOWS\
O20 - Winlogon Notify: C_1FAT - C:\WINDOWS\
O20 - Winlogon Notify: c_2mon - C:\WINDOWS\
O20 - Winlogon Notify: igm082 - igm082.dll (file missing)
O20 - Winlogon Notify: jpatD32 - jpatD32.dll (file missing)
O20 - Winlogon Notify: MAINtpp - C:\WINDOWS\
O20 - Winlogon Notify: pmnlm - C:\WINDOWS\
O20 - Winlogon Notify: ssqnkij - C:\WINDOWS\
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 8053 bytes

Scotty

Post #4February 29, 2008, 8:39 PM UTC last edited February 29, 2008, 8:39 PM UTC

Hi

We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System
Yours is SP2

[external image: Posted Image]

Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

chocokoko

Post #5March 3, 2008, 4:38 PM UTC

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

Scotty

Post #6March 3, 2008, 5:49 PM UTC

Hi

Because Combofix is very regularly updated we need to install the latest version. Please delete the combofix.exe icon from your Desktop then follow these downloading instructions again.

Please download Combofix from Bleeping Computer.

If you can't download it from there, please try these 2 alternative sites:

Forospyware
Geeks to Go

Save it to your Desktop.
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

chocokoko

Post #7March 3, 2008, 6:05 PM UTC

ComboFix 08-02-25.3 - HingWah 2008-03-03 13:03:12.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.[removed].18.297 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\New Folder\[星野?一]官能實驗\_desktop.ini

.
((((((((((((((((((((((((( Files Created from 2008-02-03 to 2008-03-03 )))))))))))))))))))))))))))))))
.

2008-02-29 11:54 . 2008-02-29 11:54 d——– C:\Program Files\Trend Micro
2008-02-25 15:54 . 2008-02-26 10:29 1,102,888 —hs—- C:\WINDOWS\SYSTEM32\voirefyh.ini
2008-02-22 17:45 . 2008-02-25 15:45 1,187,971 —hs—- C:\WINDOWS\SYSTEM32\ccmmixrm.ini
2008-02-22 16:47 . 2008-02-22 16:48 1,163,227 —hs—- C:\WINDOWS\SYSTEM32\pgwyakij.ini
2008-02-21 16:44 . 2008-02-22 16:45 1,164,392 —hs—- C:\WINDOWS\SYSTEM32\knokkegw.ini
2008-02-21 16:44 . 2008-02-27 19:54 63,850 –a—— C:\WINDOWS\BMd773d123.xml
2008-02-21 16:44 . 2008-02-28 09:29 22 –a—— C:\WINDOWS\pskt.ini
2008-02-21 15:47 . 2008-02-21 15:48 1,163,956 —hs—- C:\WINDOWS\SYSTEM32\skjcphsh.ini
2008-02-20 15:45 . 2008-02-21 15:46 1,241,401 —hs—- C:\WINDOWS\SYSTEM32\grkhydoa.ini
2008-02-20 12:45 . 2008-02-29 16:50 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-20 12:45 . 2008-02-20 12:45 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-19 15:42 . 2008-02-20 15:43 1,246,975 —hs—- C:\WINDOWS\SYSTEM32\hxrbpiln.ini
2008-02-19 14:42 . 2008-02-19 14:42 1,238,251 —hs—- C:\WINDOWS\SYSTEM32\unerwfie.ini
2008-02-18 14:39 . 2008-02-19 14:41 1,238,191 —hs—- C:\WINDOWS\SYSTEM32\jlglufvn.ini
2008-02-17 12:41 . 2008-02-18 13:36 1,248,887 —hs—- C:\WINDOWS\SYSTEM32\mvvaotnn.ini
2008-02-17 11:44 . 2008-02-17 11:44 1,248,707 —hs—- C:\WINDOWS\SYSTEM32\elxvrqsf.ini
2008-02-16 11:45 . 2008-02-16 11:45 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-16 11:43 . 2008-02-17 11:43 1,248,647 —hs—- C:\WINDOWS\SYSTEM32\hciuucdv.ini
2008-02-16 11:32 . 2008-02-16 12:42 d——– C:\Program Files\Fοnts
2008-02-16 11:32 . 2008-02-16 11:32 483,452 –a—— C:\Temp\chtOna0119.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-26 21:04 ——— d—–w C:\Documents and Settings\HingWah\Application Data\AdobeUM
2008-02-25 21:45 ——— d—–w C:\Program Files\FlashGet
2008-02-16 17:42 ——— d—–w C:\Program Files\Fοnts
2008-02-12 16:20 ——— d—–w C:\Program Files\MSN Messenger
2008-02-04 18:48 ——— d—–w C:\Program Files\MySpace
2008-02-04 18:37 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-02-04 18:30 ——— d—–w C:\Program Files\Uniblue
2008-02-04 18:30 ——— d—–w C:\Documents and Settings\HingWah\Application Data\Uniblue
2008-02-04 18:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-04 18:27 ——— d—–w C:\Program Files\Lavasoft
2008-02-04 18:27 ——— d—–w C:\Documents and Settings\HingWah\Application Data\Lavasoft
2008-01-09 01:39 ——— d—–w C:\Program Files\FLV Player
2007-12-04 22:35 74,532 —-a-w C:\WINDOWS\fccawu.dll
2006-01-19 16:11 784 —-a-w C:\Documents and Settings\HingWah\Application Data\mpauth.dat
2005-10-19 22:26 122 -c–a-w C:\Program Files\ppunistall.bat
2004-05-29 16:32 2,814 -csha-w C:\WINDOWS\agcpu.dat
2004-07-07 00:22 65,536 -csha-w C:\WINDOWS\n_yrlroq.dat
2004-01-09 06:55 4,402 -csha-w C:\WINDOWS\vpmpa.dat
2007-08-04 12:41 6,467 –sha-w C:\WINDOWS\SYSTEM32\mlnmp.bak1
2007-08-05 12:41 1,730,419 –sha-w C:\WINDOWS\SYSTEM32\mlnmp.bak2
2007-08-06 04:13 1,798,478 –sha-w C:\WINDOWS\SYSTEM32\mlnmp.ini2
2007-08-02 15:02 32,768 –sha-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012007080220070803\index.dat
2007-10-16 15:59 230,912 –sh–r C:\WINDOWS\ΑppPatch\svchost.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A85F6C9C-F658-F589-0C54-FF9A85FE4DC5}]
2007-10-16 10:58 60928 –a—— C:\WINDOWS\system32\vckhlxci.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 16:59 68856]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 09:18 1856544]
"Uniblue RegistryBooster2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 09:18 1856544]
"Uniblue SpeedUpMyPC"="C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" [2007-05-23 13:03 8631840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-12-14 15:12 180269]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-10-22 13:32 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\actMTF]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\C_1FAT]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c_2mon]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igm082]
igm082.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jpatD32]
jpatD32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MAINtpp]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnlm]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnkij]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
backup=C:\WINDOWS\pss\GStartup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^HingWah^Start Menu^Programs^Startup^Spykiller Pro v2.0.lnk]
backup=C:\WINDOWS\pss\Spykiller Pro v2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
–a—— 2003-08-29 03:59 122880 C:\WINDOWS\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
–a–c— 2002-11-22 14:49 188416 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04]
–a–c— 2002-11-22 14:48 348160 C:\WINDOWS\System32\hphmon04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD04]
–a–c— 2002-11-22 14:50 49152 C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
–a—— 2001-07-08 22:50 155648 C:\WINDOWS\system32\\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2003-04-24 16:58 4616192 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2005-10-22 13:32 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
–a–c— 2002-04-17 09:42 69632 C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2004-02-22 22:44 32881 C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2005-12-14 15:12 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updater]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
–a—— 2004-11-12 12:24 106557 C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winva32.exe]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"16918:TCP"= 16918:TCP:BitComet 16918 TCP
"16918:UDP"= 16918:UDP:BitComet 16918 UDP
"7681:TCP"= 7681:TCP:BitComet 7681 TCP
"7681:UDP"= 7681:UDP:BitComet 7681 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 dhlp;dhlp;C:\WINDOWS\system32\Drivers\dhlp.sys [2007-12-15 11:09]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.
Contents of the 'Scheduled Tasks' folder
"2008-03-03 18:05:03 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-02-12 16:04:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 15:03:59 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 17:14:58 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 13:07:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\conime.exe
.
**************************************************************************
.
Completion time: 2008-03-03 13:13:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-03 18:12:58
ComboFix2.txt 2008-02-28 16:06:23
.
2008-02-13 08:03:44 — E O F —

"AllowInboundEchoRequest"= 1 (0x1)

R0 dhlp;dhlp;C:\WINDOWS\system32\Drivers\dhlp.sys [2007-12-15 11:09]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.
Contents of the 'Scheduled Tasks' folder
"2008-03-03 18:05:03 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-02-12 16:04:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 15:03:59 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 17:14:58 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 13:07:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\conime.exe
.
**************************************************************************
.
Completion time: 2008-03-03 13:13:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-03 18:12:58
ComboFix2.txt 2008-02-28 16:06:23
.
2008-02-13 08:03:44 — E O F —

Scotty

Post #8March 3, 2008, 9:50 PM UTC

Hi

Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

KillAll::
 
File::
C:\WINDOWS\SYSTEM32\voirefyh.ini
C:\WINDOWS\SYSTEM32\ccmmixrm.ini
C:\WINDOWS\SYSTEM32\pgwyakij.ini
C:\WINDOWS\SYSTEM32\knokkegw.ini
C:\WINDOWS\BMd773d123.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\SYSTEM32\skjcphsh.ini
C:\WINDOWS\SYSTEM32\grkhydoa.ini
C:\WINDOWS\SYSTEM32\hxrbpiln.ini
C:\WINDOWS\SYSTEM32\unerwfie.ini
C:\WINDOWS\SYSTEM32\jlglufvn.ini
C:\WINDOWS\SYSTEM32\mvvaotnn.ini
C:\WINDOWS\SYSTEM32\elxvrqsf.ini
C:\WINDOWS\SYSTEM32\hciuucdv.ini
C:\Temp\chtOna0119.exe
C:\WINDOWS\fccawu.dll
C:\WINDOWS\agcpu.dat
C:\WINDOWS\n_yrlroq.dat
C:\WINDOWS\vpmpa.dat
C:\WINDOWS\SYSTEM32\mlnmp.bak1
C:\WINDOWS\SYSTEM32\mlnmp.bak2
C:\WINDOWS\SYSTEM32\mlnmp.ini2
C:\WINDOWS\ΑppPatch\svchost.exe
C:\WINDOWS\system32\Drivers\dhlp.sys

Folder::
C:\Program Files\Fοnts
C:\Documents and Settings\All Users\Application Data\Rabio

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A85F6C9C-F658-F589-0C54-FF9A85FE4DC5}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\actMTF]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\C_1FAT]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c_2mon]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igm082]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jpatD32]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MAINtpp]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnlm]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqnkij]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updater]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winva32.exe]

Driver::
dhlp

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

chocokoko

Post #9March 4, 2008, 3:37 PM UTC

after i drag and drop, the combo fix loading icon appear and than another screen appear for a split sec. and disappears and than nothing happens

(sorry for the really long run on sentance)

what do i do ?

Scotty

Post #10March 4, 2008, 6:03 PM UTC

Hi Try deleting the Combofix.exe again and downloading a fresh copy. Then run the script again.

chocokoko

Post #11March 4, 2008, 7:37 PM UTC

"2008-03-04 19:05:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-02-12 16:04:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 15:03:59 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 17:14:58 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-04 14:32:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\conime.exe
.
**************************************************************************
.
Completion time: 2008-03-04 14:37:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-04 19:37:37
ComboFix2.txt 2008-03-03 18:13:03
ComboFix3.txt 2008-02-28 16:06:23
.
2008-02-13 08:03:44 — E O F —

ComboFix 08-02-25.3 - HingWah 2008-03-04 14:25:30.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.[removed].18.279 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\HingWah\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Temp\chtOna0119.exe
C:\WINDOWS\agcpu.dat
C:\WINDOWS\BMd773d123.xml
C:\WINDOWS\fccawu.dll
C:\WINDOWS\n_yrlroq.dat
C:\WINDOWS\pskt.ini
C:\WINDOWS\SYSTEM32\ccmmixrm.ini
C:\WINDOWS\system32\Drivers\dhlp.sys
C:\WINDOWS\SYSTEM32\elxvrqsf.ini
C:\WINDOWS\SYSTEM32\grkhydoa.ini
C:\WINDOWS\SYSTEM32\hciuucdv.ini
C:\WINDOWS\SYSTEM32\hxrbpiln.ini
C:\WINDOWS\SYSTEM32\jlglufvn.ini
C:\WINDOWS\SYSTEM32\knokkegw.ini
C:\WINDOWS\SYSTEM32\mlnmp.bak1
C:\WINDOWS\SYSTEM32\mlnmp.bak2
C:\WINDOWS\SYSTEM32\mlnmp.ini2
C:\WINDOWS\SYSTEM32\mvvaotnn.ini
C:\WINDOWS\SYSTEM32\pgwyakij.ini
C:\WINDOWS\SYSTEM32\skjcphsh.ini
C:\WINDOWS\SYSTEM32\unerwfie.ini
C:\WINDOWS\SYSTEM32\voirefyh.ini
C:\WINDOWS\vpmpa.dat
C:\WINDOWS\ΑppPatch\svchost.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Rabio
C:\New Folder\[星野?一]官能實驗\_desktop.ini
C:\Program Files\Fοnts
C:\Temp\chtOna0119.exe
C:\WINDOWS\agcpu.dat
C:\WINDOWS\BMd773d123.xml
C:\WINDOWS\fccawu.dll
C:\WINDOWS\n_yrlroq.dat
C:\WINDOWS\pskt.ini
C:\WINDOWS\SYSTEM32\ccmmixrm.ini
C:\WINDOWS\system32\Drivers\dhlp.sys
C:\WINDOWS\SYSTEM32\elxvrqsf.ini
C:\WINDOWS\SYSTEM32\grkhydoa.ini
C:\WINDOWS\SYSTEM32\hciuucdv.ini
C:\WINDOWS\SYSTEM32\hxrbpiln.ini
C:\WINDOWS\SYSTEM32\jlglufvn.ini
C:\WINDOWS\SYSTEM32\knokkegw.ini
C:\WINDOWS\SYSTEM32\mlnmp.bak1
C:\WINDOWS\SYSTEM32\mlnmp.bak2
C:\WINDOWS\SYSTEM32\mlnmp.ini2
C:\WINDOWS\SYSTEM32\mvvaotnn.ini
C:\WINDOWS\SYSTEM32\pgwyakij.ini
C:\WINDOWS\SYSTEM32\skjcphsh.ini
C:\WINDOWS\SYSTEM32\unerwfie.ini
C:\WINDOWS\SYSTEM32\voirefyh.ini
C:\WINDOWS\vpmpa.dat
C:\WINDOWS\ΑppPatch\svchost.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DHLP
——-\dhlp

((((((((((((((((((((((((( Files Created from 2008-02-04 to 2008-03-04 )))))))))))))))))))))))))))))))
.

2008-03-04 14:24 . 2008-03-04 14:24 d——– C:\ComboFix(2)
2008-03-04 14:24 . 2004-08-04 02:56 388,608 –a—— C:\WINDOWS\SYSTEM32\CF11658.exe
2008-03-04 14:23 . 2004-08-04 02:56 388,608 –a—— C:\WINDOWS\SYSTEM32\CF11544.exe
2008-03-04 10:41 . 2004-08-04 02:56 388,608 –a—— C:\WINDOWS\SYSTEM32\CF766.exe
2008-03-04 10:39 . 2004-08-04 02:56 388,608 –a—— C:\WINDOWS\SYSTEM32\CF318.exe
2008-02-29 11:54 . 2008-02-29 11:54 d——– C:\Program Files\Trend Micro
2008-02-20 12:45 . 2008-02-29 16:50 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-20 12:45 . 2008-02-20 12:45 1,409 –a—— C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-26 21:04 ——— d—–w C:\Documents and Settings\HingWah\Application Data\AdobeUM
2008-02-25 21:45 ——— d—–w C:\Program Files\FlashGet
2008-02-12 16:20 ——— d—–w C:\Program Files\MSN Messenger
2008-02-04 18:48 ——— d—–w C:\Program Files\MySpace
2008-02-04 18:37 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-02-04 18:30 ——— d—–w C:\Program Files\Uniblue
2008-02-04 18:30 ——— d—–w C:\Documents and Settings\HingWah\Application Data\Uniblue
2008-02-04 18:29 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-04 18:27 ——— d—–w C:\Program Files\Lavasoft
2008-02-04 18:27 ——— d—–w C:\Documents and Settings\HingWah\Application Data\Lavasoft
2008-01-09 01:39 ——— d—–w C:\Program Files\FLV Player
2006-01-19 16:11 784 —-a-w C:\Documents and Settings\HingWah\Application Data\mpauth.dat
2005-10-19 22:26 122 -c–a-w C:\Program Files\ppunistall.bat
2007-08-02 15:02 32,768 –sha-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012007080220070803\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 16:59 68856]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 09:18 1856544]
"Uniblue RegistryBooster2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 09:18 1856544]
"Uniblue SpeedUpMyPC"="C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" [2007-05-23 13:03 8631840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-12-14 15:12 180269]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-10-22 13:32 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
backup=C:\WINDOWS\pss\GStartup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^HingWah^Start Menu^Programs^Startup^Spykiller Pro v2.0.lnk]
backup=C:\WINDOWS\pss\Spykiller Pro v2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
–a—— 2003-08-29 03:59 122880 C:\WINDOWS\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
–a–c— 2002-11-22 14:49 188416 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04]
–a–c— 2002-11-22 14:48 348160 C:\WINDOWS\System32\hphmon04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD04]
–a–c— 2002-11-22 14:50 49152 C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 11:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
–a—— 2001-07-08 22:50 155648 C:\WINDOWS\system32\\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2003-04-24 16:58 4616192 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2005-10-22 13:32 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
–a–c— 2002-04-17 09:42 69632 C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2004-02-22 22:44 32881 C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2005-12-14 15:12 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
–a—— 2004-11-12 12:24 106557 C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"16918:TCP"= 16918:TCP:BitComet 16918 TCP
"16918:UDP"= 16918:UDP:BitComet 16918 UDP
"7681:TCP"= 7681:TCP:BitComet 7681 TCP
"7681:UDP"= 7681:UDP:BitComet 7681 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.
Contents of the 'Scheduled Tasks' folder
"2008-03-04 19:05:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-02-12 16:04:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 15:03:59 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-08-06 17:14:58 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-04 14:32:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\conime.exe
.
**************************************************************************
.
Completion time: 2008-03-04 14:37:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-04 19:37:37
ComboFix2.txt 2008-03-03 18:13:03
ComboFix3.txt 2008-02-28 16:06:23
.
2008-02-13 08:03:44 — E O F —

Scotty

Post #12March 4, 2008, 9:38 PM UTC

Hi

Go to http://virusscan.jotti.org
Copy the following line into the white textbox:
C:\WINDOWS\SYSTEM32\CF11658.exe
Click Submit.
Please post the results of this scan to this thread.

Do the same for these files:
C:\WINDOWS\SYSTEM32\CF11544.exe
C:\WINDOWS\SYSTEM32\CF766.exe

chocokoko

Post #13March 4, 2008, 10:56 PM UTC

All found nothing for all three

Scotty

Post #14March 5, 2008, 10:11 AM UTC

Hi

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post with a new HijackThis log..

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed until the scan is complete. This includes your anti-virus. Once you have installed the Scanner, and the updated definitions, you can disconnect from the Internet.Re-enable the anti-virus before reconnecting to the Internet.

chocokoko

Post #15March 6, 2008, 3:19 PM UTC

KASPERSKY ONLINE SCANNER REPORT 2008-03-05 15:46 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 5/03/2008 Kaspersky Anti-Virus database records: 599162 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ G:\ Scan Statistics Total number of scanned objects 74658 Number of viruses found 52 Number of infected objects 205 Number of suspicious objects 0 Duration of the scan process 00:57:31 Infected Object Name Virus Name Last Action C:\Documents and Settings\HingWah\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\HingWah\Desktop\OiUninstaller.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.gr skipped C:\Documents and Settings\HingWah\Desktop\OiUninstaller.exe NSIS: infected - 1 skipped C:\Documents and Settings\HingWah\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\HingWah\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\HingWah\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\HingWah\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\HingWah\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\HingWah\ntuser.dat Object is locked skipped C:\Documents and Settings\HingWah\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Downdloaded Programs\fgf140.exe/WISE0018.BIN/cd_clint.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped C:\Downdloaded Programs\fgf140.exe/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.Cydoor skipped C:\Downdloaded Programs\fgf140.exe WiseSFX: infected - 2 skipped C:\Program Files\BitComet\Downloads\Anti-Adware Pack\Anti-Adware Pack\Trojan Remover 6.6.0\trsetup.exe/data0002/data.rar/ClearEL.exe Infected: HackTool.Win32.Clearlog.b skipped C:\Program Files\BitComet\Downloads\Anti-Adware Pack\Anti-Adware Pack\Trojan Remover 6.6.0\trsetup.exe/data0002/data.rar Infected: HackTool.Win32.Clearlog.b skipped C:\Program Files\BitComet\Downloads\Anti-Adware Pack\Anti-Adware Pack\Trojan Remover 6.6.0\trsetup.exe/data0002 Infected: HackTool.Win32.Clearlog.b skipped C:\Program Files\BitComet\Downloads\Anti-Adware Pack\Anti-Adware Pack\Trojan Remover 6.6.0\trsetup.exe/data0003/data.rar/spoolsv.exe Infected: Trojan-Downloader.Win32.Banload.bat skipped C:\Program Files\BitComet\Downloads\Anti-Adware Pack\Anti-Adware Pack\Trojan Remover 6.6.0\trsetup.exe/data0003/data.rar Infected: Trojan-Downloader.Win32.Banload.bat skipped C:\Program Files\BitComet\Downloads\Anti-Adware Pack\Anti-Adware Pack\Trojan Remover 6.6.0\trsetup.exe/data0003 Infected: Trojan-Downloader.Win32.Banload.bat skipped C:\Program Files\BitComet\Downloads\Anti-Adware Pack\Anti-Adware Pack\Trojan Remover 6.6.0\trsetup.exe NSIS: infected - 6 skipped C:\Program Files\Common Files\DriveCleaner Freeware\dcsm.exe Infected: not-a-virus:Downloader.Win32.WinFixer.ah skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp10.tmp.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.vs skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp144.tmp.exe.vir Infected: not-a-virus:AdWare.Win32.BHO.zk skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp16C.tmp.exe.vir Infected: Trojan.Win32.BHO.awm skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp27.tmp.exe.vir Infected: Trojan.Win32.Qhost.wu skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp36.tmp.exe.vir Infected: Trojan.Win32.Agent.bur skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp50.tmp.exe.vir Infected: not-a-virus:AdWare.Win32.BHO.zm skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp70.tmp.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jes skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp72.tmp.exe.vir Infected: Trojan.Win32.BHO.aol skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp7A.tmp.exe.vir Infected: Trojan.Win32.Agent.bur skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmp86.tmp.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ajj skipped C:\QooBox\Quarantine\C\Documents and Settings\HingWah\Application Data\tmpF.tmp.exe.vir Infected: Trojan.Win32.Agent.bur skipped C:\QooBox\Quarantine\C\Program Files\Common Files\SpyGuardPro\bm.exe.vir Infected: not-a-virus:Downloader.Win32.WinFixer.cv skipped C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1122OinAdmin.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.eh skipped C:\QooBox\Quarantine\C\Program Files\Internet Explorer\promyfsywuewu.html.vir Infected: Trojan-Clicker.HTML.IFrame.dn skipped C:\QooBox\Quarantine\C\Program Files\livabigas89104.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.d skipped C:\QooBox\Quarantine\C\Program Files\Network Monitor\netmon.exe.vir Infected: not-a-virus:Monitor.Win32.NetMon.a skipped C:\QooBox\Quarantine\C\Temp\chtOna0119.exe.vir/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped C:\QooBox\Quarantine\C\Temp\chtOna0119.exe.vir/data0003 Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\QooBox\Quarantine\C\Temp\chtOna0119.exe.vir/data0004 Infected: Trojan-Downloader.Win32.Small.ijp skipped C:\QooBox\Quarantine\C\Temp\chtOna0119.exe.vir/data0005/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped C:\QooBox\Quarantine\C\Temp\chtOna0119.exe.vir/data0005 Infected: not-a-virus:AdWare.Win32.TTC.d skipped C:\QooBox\Quarantine\C\Temp\chtOna0119.exe.vir/data0006 Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\QooBox\Quarantine\C\Temp\chtOna0119.exe.vir NSIS: infected - 6 skipped C:\QooBox\Quarantine\C\WINDOWS\fccawu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bks skipped C:\QooBox\Quarantine\C\WINDOWS\g4356cbvy63.exe.vir Infected: Trojan.Win32.VB.bfw skipped C:\QooBox\Quarantine\C\WINDOWS\mrofinu572.exe.vir Infected: Trojan-Downloader.Win32.Agent.jal skipped C:\QooBox\Quarantine\C\WINDOWS\SGluZ1dhaA\asappsrv.dll.vir Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\QooBox\Quarantine\C\WINDOWS\SGluZ1dhaA\command.exe.vir Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\a1\tliamdll2.exe.vir Infected: Trojan-Downloader.Win32.Small.buy skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\aocsejpf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\axfryrxi.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\dhlp.sys.vir Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\gwpiwjwj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ineWc01\ineWc011065.exe.vir Infected: Trojan-Downloader.Win32.VB.cby skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\k5\thgd2241dll.exe.vir Infected: Trojan-Downloader.Win32.Small.ijp skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kbxmdgwu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ixf skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kdqdvivv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ldfpgkht.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lomjrtdl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\mtynqlve.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nGpxx01\nGpxx011065.exe.vir Infected: Trojan-Downloader.Win32.VB.cgu skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nmxvelwn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\obylfocq.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\p9\liopud89104.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\p9\liopud89104.exe.vir NSIS: infected - 1 skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qdkvrdlo.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qnnsjlsh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rmypscvd.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rwnhkobk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\sahbbyhr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\skrxmern.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\sttlqbqh.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\theuiomp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp11E.tmp.dll.vir Infected: Trojan.Win32.BHO.yi skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp16C.tmp.dll.vir Infected: Trojan.Win32.BHO.de skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp197.tmp.dll.vir Infected: Trojan.Win32.BHO.sn skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp21EE.tmp.dll.vir Infected: Trojan.Win32.BHO.yi skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp377.tmp.dll.vir Infected: Trojan.Win32.BHO.nk skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp50.tmp.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.zl skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp6A6.tmp.dll.vir Infected: Trojan.Win32.BHO.yi skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp72.tmp.dll.vir Infected: Trojan.Win32.BHO.yi skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmp82.tmp.dll.vir Infected: Trojan.Win32.BHO.yi skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tmpC75.tmp.dll.vir Infected: Trojan.Win32.BHO.yi skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tyfcmihl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.ixf skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uovabjxm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uoymjamj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\version69ie7fix.dll.vir Infected: not-a-virus:AdWare.Win32.Mirar.n skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\w11\hiba3133.exe.vir Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\windows.vir Infected: Trojan.Win32.Zapchast.dt skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\X1\kmhp83122.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\X1\kmhp83122.exe.vir NSIS: infected - 1 skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xuolqjdn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\uninst1014.exe.vir Infected: Trojan.Win32.VB.bfw skipped C:\QooBox\Quarantine\C\WINDOWS\uni_eh44.exe.vir Infected: Trojan.Win32.VB.bfv skipped C:\QooBox\Quarantine\catchme2008-02-28_110049.10.zip/gebcbbx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\catchme2008-02-28_110049.10.zip/kvpgizqc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\catchme2008-02-28_110049.10.zip/sstqp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\catchme2008-02-28_110049.10.zip ZIP: infected - 3 skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1681\A0277505.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1681\A0277510.exe Infected: Trojan-Downloader.Win32.Agent.jal skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1681\A0277511.exe Infected: Trojan-Downloader.Win32.Agent.jal skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0278500.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0278505.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279504.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279512.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279517.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gv skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279518.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gw skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279520.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279523.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279523.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279524.exe Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279529.exe Infected: Trojan-Downloader.Win32.PurityScan.fj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0279535.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280534.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280537.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280538.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280543.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280551.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280555.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280561.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280568.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280580.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1682\A0280588.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0280593.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0280594.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0280600.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0280606.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0280611.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0280619.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281626.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281632.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281642.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281644.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281645.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281651.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281662.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281666.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281667.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281674.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281680.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281683.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1683\A0281686.dll Infected: not-a-virus:AdWare.Win32.Rabio.h skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1685\A0281695.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1685\A0282676.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1685\A0282729.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1685\A0285748.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290855.exe Infected: not-a-virus:Downloader.Win32.WinFixer.cv skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290857.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290903.exe Infected: Trojan-Downloader.Win32.VB.cby skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290907.dll Infected: not-a-virus:AdWare.Win32.Mirar.n skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290911.exe Infected: Trojan.Win32.VB.bfw skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290912.exe Infected: Trojan.Win32.VB.bfv skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290913.exe Infected: Trojan.Win32.VB.bfw skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290919.exe Infected: Trojan-Downloader.Win32.PurityScan.eh skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290923.dll Infected: Trojan.Win32.BHO.yi skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290924.dll Infected: Trojan.Win32.BHO.de skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290925.dll Infected: Trojan.Win32.BHO.sn skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290926.dll Infected: Trojan.Win32.BHO.yi skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290927.dll Infected: Trojan.Win32.BHO.nk skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290928.dll Infected: not-a-virus:AdWare.Win32.BHO.zl skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290929.dll Infected: Trojan.Win32.BHO.yi skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290930.dll Infected: Trojan.Win32.BHO.yi skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290931.dll Infected: Trojan.Win32.BHO.yi skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290932.dll Infected: Trojan.Win32.BHO.yi skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290933.exe Infected: Trojan-Downloader.Win32.Agent.jal skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290934.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.vs skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290938.exe Infected: not-a-virus:AdWare.Win32.BHO.zk skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290940.exe Infected: Trojan.Win32.BHO.awm skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290947.exe Infected: Trojan.Win32.Qhost.wu skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290949.exe Infected: Trojan.Win32.Agent.bur skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290952.exe Infected: not-a-virus:AdWare.Win32.BHO.zm skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290958.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.jes skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290959.exe Infected: Trojan.Win32.BHO.aol skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290960.exe Infected: Trojan.Win32.Agent.bur skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290962.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.ajj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290967.exe Infected: Trojan.Win32.Agent.bur skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290970.dll Infected: not-a-virus:AdWare.Win32.TTC.d skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290971.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290973.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290974.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290975.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290976.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290977.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290978.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290979.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290980.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290981.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290982.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290983.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290984.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290985.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290986.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290987.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290988.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290989.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290990.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixf skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290991.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290992.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290993.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290995.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290997.exe Infected: Trojan-Downloader.Win32.Small.buy skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290998.exe Infected: Trojan-Downloader.Win32.Small.ijp skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290999.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0290999.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0291000.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0291000.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0291001.exe Infected: not-a-virus:AdWare.Win32.Rabio.g skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0291002.exe Infected: Trojan-Downloader.Win32.VB.cgu skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1687\A0291003.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1692\A0293262.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bks skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1692\A0293265.sys Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1692\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{1E8DB128-C331-40D7-8D70-D9D1741C797E}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\ddcca.exe Infected: Trojan-Dropper.Win32.Mudrop.fx skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. 52 viruses?? Help Scotty!!! Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Please Help~

✨ Ask AI

Ask AI