What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Win32:Rontokbr-I2 [Wrm] - still having problems

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi. Just a noob looking for a solution. I don't really understand logs so i can't actually spot the differences between them.

Been having the same problem with Chaitanyak. Followed this procedure:

Step 1:
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

————————————————————————————————————————————————————————————
Step 2:
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

————————————————————————————————————————————————————————————
Step 3:
Download ComboFix from Here to your Desktop.
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

I'm posting first log:
ComboFix 08-03-10.1 - user 2008-03-11 11:56:42.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.291 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\New Folder\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))
.

2008-03-11 11:04 . 2007-12-04 21:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2008-03-11 11:04 . 2004-01-09 17:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2008-03-11 11:04 . 2007-12-04 20:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2008-03-11 11:04 . 2007-12-04 22:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-11 11:04 . 2007-12-04 22:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-11 11:04 . 2007-12-04 22:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-11 11:04 . 2007-12-04 22:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-11 11:04 . 2007-12-04 22:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-08 18:56 . 2008-03-08 18:56 d–hs—- C:\WINDOWS\ftpcache
2008-03-08 18:12 . 2008-03-08 20:07 d——– C:\Program Files\videos
2008-03-07 13:19 . 2008-03-07 13:19 d——– C:\Program Files\Real Alternative
2008-03-07 11:56 . 2008-03-07 11:56 d——– C:\Program Files\Alwil Software
2008-03-04 09:45 . 2008-03-04 09:46 d——– C:\dj845

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-07 01:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
.

((((((((((((((((((((((((((((( snapshot@2008-03-11_ 9.57.29.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-11 02:11:11 262,144 —-a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2008-03-11 03:36:22 16,384 —-atw C:\WINDOWS\TEMP\Perflib_Perfdata_4f0.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:07 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 21:49 4662776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [ ]
"MCUpdateExe"="C:\PROGRA~1\McAfee.com\Agent\bak\McUpdate.exe" [ ]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [ ]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe" [ ]
"McRegWiz"="C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-02 01:47 196608]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 21:00 79224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 09:07 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNSE]
C:\Program Files\Common Files\DriveCleaner Free\DNSE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveCleaner Free]
C:\Program Files\DriveCleaner Free\UDC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pas_check]
C:\Program Files\SystemDoctor 2006 Free\pasmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
–a—— 2006-06-15 12:36 229376 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
–a—— 2006-06-27 16:21 1449984 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winehq.org]
C:\WINDOWS\ssrsss.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2006-11-30 21:49 4662776 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0443ccb0-7c69-11dc-87c6-00051c09becc}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe desktop.ini.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30bfbe02-f2c6-11db-8747-000795ca5383}]
\Shell\AutoRun\command - password_viewer.exe %1
\Shell\Explore\command - password_viewer.exe %1
\Shell\Open\command - password_viewer.exe %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77338750-454b-11dc-8790-000795ca5383}]
\Shell\0pen\command - krag.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL krag.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84eaf150-c89b-11dc-87fd-000795ca5383}]
\Shell\AutoRun\command - password_viewer.exe %1
\Shell\Explore\command - password_viewer.exe %1
\Shell\Open\command - password_viewer.exe %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{947e9e01-7254-11d6-870f-000795ca5383}]
\Shell\AutoRun\command - New Folder.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f40e6960-437f-11dc-878e-000795ca5383}]
\Shell\0pen\command - krag.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL krag.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f81d42f0-ac3c-11db-8711-000795ca5383}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe desktop.ini.vbs

*Newly Created Service* - ASWUPDSV
*Newly Created Service* - AVAST!_ANTIVIRUS
*Newly Created Service* - AVAST!_MAIL_SCANNER
*Newly Created Service* - AVAST!_WEB_SCANNER
.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 03:58:00 C:\WINDOWS\Tasks\McAfee.com Update Check (LANICPU-user).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-11 11:58:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-11 11:59:51
ComboFix-quarantined-files.txt 2008-03-11 03:59:40
ComboFix2.txt 2008-03-11 03:01:38
ComboFix3.txt 2008-03-11 02:51:37
ComboFix4.txt 2008-03-11 02:16:32
ComboFix5.txt 2008-03-11 01:58:16

————————————————————————————————————————————————————————————
Step 4:
download & run this file - Flash_Disinfector.exe

————————————————————————————————————————————————————————————
Step 5:
Open notepad and copy/paste the text in the quotebox below into it:


QUOTE
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1056bff9-4c07-11dc-868d-001a4d747b97}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{caa4222c-55f5-11dc-8698-001a4d747b97}]


Save this as Save this as "CFScript"




Refering to the picture above, drag CFScript.txt into ComboFix.exe

Posting new log:
ComboFix 08-03-10.1 - user 2008-03-11 12:07:27.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.280 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\New Folder\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Desktop\New Folder\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-11 to 2008-03-11 )))))))))))))))))))))))))))))))
.

2008-03-11 11:04 . 2007-12-04 21:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2008-03-11 11:04 . 2004-01-09 17:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2008-03-11 11:04 . 2007-12-04 20:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2008-03-11 11:04 . 2007-12-04 22:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-11 11:04 . 2007-12-04 22:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-11 11:04 . 2007-12-04 22:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-11 11:04 . 2007-12-04 22:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-11 11:04 . 2007-12-04 22:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-08 18:56 . 2008-03-08 18:56 d–hs—- C:\WINDOWS\ftpcache
2008-03-08 18:12 . 2008-03-08 20:07 d——– C:\Program Files\videos
2008-03-07 13:19 . 2008-03-07 13:19 d——– C:\Program Files\Real Alternative
2008-03-07 11:56 . 2008-03-07 11:56 d——– C:\Program Files\Alwil Software
2008-03-04 09:45 . 2008-03-04 09:46 d——– C:\dj845

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-07 01:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
.

((((((((((((((((((((((((((((( snapshot@2008-03-11_ 9.57.29.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-11 02:11:11 262,144 —-a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2008-03-11 03:36:22 16,384 —-atw C:\WINDOWS\TEMP\Perflib_Perfdata_4f0.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 49,152 2005-07-23 03:25:04 C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe

—-a-w 241,664 2003-12-22 00:38:42 C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe

—-a-w 33,792 2004-12-20 18:41:22 C:\Program Files\Winamp\bak\winampa.exe

—-a-w 15,360 2004-08-04 01:07:00 C:\WINDOWS\system32\bak\ctfmon.exe
—-a-w 15,360 2004-08-04 01:07:00 C:\WINDOWS\system32\ctfmon.exe

—-a-w 172,032 2005-07-23 03:25:06 C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb10.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:07 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 21:49 4662776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [ ]
"MCUpdateExe"="C:\PROGRA~1\McAfee.com\Agent\bak\McUpdate.exe" [ ]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [ ]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe" [ ]
"McRegWiz"="C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-02 01:47 196608]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 21:00 79224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 09:07 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNSE]
C:\Program Files\Common Files\DriveCleaner Free\DNSE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveCleaner Free]
C:\Program Files\DriveCleaner Free\UDC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pas_check]
C:\Program Files\SystemDoctor 2006 Free\pasmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
–a—— 2006-06-15 12:36 229376 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
–a—— 2006-06-27 16:21 1449984 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winehq.org]
C:\WINDOWS\ssrsss.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2006-11-30 21:49 4662776 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0443ccb0-7c69-11dc-87c6-00051c09becc}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe desktop.ini.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30bfbe02-f2c6-11db-8747-000795ca5383}]
\Shell\AutoRun\command - password_viewer.exe %1
\Shell\Explore\command - password_viewer.exe %1
\Shell\Open\command - password_viewer.exe %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77338750-454b-11dc-8790-000795ca5383}]
\Shell\0pen\command - krag.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL krag.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84eaf150-c89b-11dc-87fd-000795ca5383}]
\Shell\AutoRun\command - password_viewer.exe %1
\Shell\Explore\command - password_viewer.exe %1
\Shell\Open\command - password_viewer.exe %1

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{947e9e01-7254-11d6-870f-000795ca5383}]
\Shell\AutoRun\command - New Folder.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f40e6960-437f-11dc-878e-000795ca5383}]
\Shell\0pen\command - krag.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL krag.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f81d42f0-ac3c-11db-8711-000795ca5383}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe desktop.ini.vbs

*Newly Created Service* - ASWUPDSV
*Newly Created Service* - AVAST!_ANTIVIRUS
*Newly Created Service* - AVAST!_MAIL_SCANNER
*Newly Created Service* - AVAST!_WEB_SCANNER
.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 04:08:00 C:\WINDOWS\Tasks\McAfee.com Update Check (LANICPU-user).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.ex
- C:\PROGRA~1\mcafee.com\agent
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-11 12:08:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-11 12:10:28
ComboFix-quarantined-files.txt 2008-03-11 04:10:19
ComboFix2.txt 2008-03-11 03:59:52
ComboFix3.txt 2008-03-11 03:01:38
ComboFix4.txt 2008-03-11 02:51:37
ComboFix5.txt 2008-03-11 02:16:32
————————————————————————————————————————————————————————————

I did the same procedure with and without avast but it seems the same problem keeps popping up.

Is there anything else I missed doing?

Thanks in advance
Post #2
[external image: Posted Image]

Sorry about the delay in responding :(

If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.

Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI