Spyware / Malware / Virus Removal

[Resolved] Removing Tavo.exe and Kavo.exe

12 min read

Looking for the outcome? Ask AI

abcdefGARY Topic Starter

Post #1March 19, 2008, 11:12 PM UTC last edited March 30, 2008, 8:23 PM UTC

Hello. I found this forum through a search on Google about how to remove the Tavo.exe and Kavo.exe errors that popup whenever I start Windows XP Professional. I am also trying to get rid of an "i8.com" error message popping up for no reason. This is happening on my Dad's computer, as I am using OS X, but I am trying to help him fix it.

I had found a similar problem, which was resolved, found here. I followed all the necessary steps. And here is everything that I have done so far:

1.) Downloaded HijackThis and removed the following:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [tava] C:\WINDOWS\system32\tavo.exe
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe

2.) I have done a Kaspersky Online Scan and these were the results:

——————————————————————————-
 KASPERSKY ONLINE SCANNER REPORT
 Tuesday, March 18, 2008 2:51:19 PM
 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
 Kaspersky Online Scanner version: 5.0.98.0
 Kaspersky Anti-Virus database last update: 19/03/2008
 Kaspersky Anti-Virus database records: 641323
——————————————————————————-

Scan Settings:
	Scan using the following antivirus database: extended
	Scan Archives: true
	Scan Mail Bases: true

Scan Target - My Computer:
	A:\
	C:\
	D:\
	E:\

Scan Statistics:
	Total number of scanned objects: 27051
	Number of viruses found: 2
	Number of infected objects: 27
	Number of suspicious objects: 0
	Duration of the scan process: 01:26:37

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\index.qbs	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\2F22478D.TMP	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\contactgroup256.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\dyncontent\bundle.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\index2.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\profile4096.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\user1024.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\user256.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Messenger\[My Email Address]\SharingMetadata\Logs\Dfsr00004.log	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Messenger\[My Email Address]\SharingMetadata\pending.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Messenger\[My Email Address]\SharingMetadata\Working\database_26F4_6BE7_F46B_B827\dfsr.db	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Messenger\[My Email Address]\SharingMetadata\Working\database_26F4_6BE7_F46B_B827\fsr.log	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Messenger\[My Email Address]\SharingMetadata\Working\database_26F4_6BE7_F46B_B827\fsrtmp.log	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Messenger\[My Email Address]\SharingMetadata\Working\database_26F4_6BE7_F46B_B827\tmp.edb	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows Live Contacts\[My Email Address]\real\members.stg	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows Live Contacts\[My Email Address]\shadow\members.stg	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Mozilla\Firefox\Profiles\1vcd4ouk.default\Cache\1A2F37EDd01/keyfinder.exe/data.rar/xpkey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Mozilla\Firefox\Profiles\1vcd4ouk.default\Cache\1A2F37EDd01/keyfinder.exe/data.rar/officekey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Mozilla\Firefox\Profiles\1vcd4ouk.default\Cache\1A2F37EDd01/keyfinder.exe/data.rar	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Mozilla\Firefox\Profiles\1vcd4ouk.default\Cache\1A2F37EDd01/keyfinder.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Mozilla\Firefox\Profiles\1vcd4ouk.default\Cache\1A2F37EDd01	RAR: infected - 4	skipped
C:\Documents and Settings\Frank\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF61D4.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF620C.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF8863.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF88AA.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\Frank\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG	Object is locked	skipped
C:\i8.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAD.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWADMT.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.ldb	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AutoProtect.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AVContext.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AVManual.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\Backup.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetPageViewHistory.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetSearchHistory.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetTempFiles.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUWindowsTempFiles.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\EmailScan.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\InternetSecurity.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISIntrusionPrevented.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISIOTraffic.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISNewNetwork.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\LiveUpdate.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\NCO.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VABrowserSettings.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VAIPAddresses.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VAWeakPasswords.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\WDFScanner.log	Object is locked	skipped
C:\System Volume Information\MountPointManagerRemoteDatabase	Object is locked	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0003957.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar/xpkey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar/officekey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe	RAR: infected - 4	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004452.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004453.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP16\A0004456.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004462.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004473.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004474.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004482.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004483.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004491.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004492.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004499.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004500.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004501.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\change.log	Object is locked	skipped
C:\WINDOWS\Debug\PASSWD.LOG	Object is locked	skipped
C:\WINDOWS\SchedLgU.Txt	Object is locked	skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\edb.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb	Object is locked	skipped
C:\WINDOWS\system32\config\AppEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\default	Object is locked	skipped
C:\WINDOWS\system32\config\default.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SAM	Object is locked	skipped
C:\WINDOWS\system32\config\SAM.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SecEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\software	Object is locked	skipped
C:\WINDOWS\system32\config\software.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SysEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\system	Object is locked	skipped
C:\WINDOWS\system32\config\system.LOG	Object is locked	skipped
C:\WINDOWS\system32\drivers\etc\Hosts.bak	Object is locked	skipped
C:\WINDOWS\system32\kavo.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\WINDOWS\system32\kavo0.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	Object is locked	skipped
C:\WINDOWS\Temp\cc2.tmp	Object is locked	skipped
C:\WINDOWS\Temp\JETBB6C.tmp	Object is locked	skipped
C:\WINDOWS\Temp\JETBD60.tmp	Object is locked	skipped
C:\WINDOWS\WindowsUpdate.log	Object is locked	skipped

Scan process completed.

3.) I have used ComboFix and this is my ComboFix.txt:

ComboFix 08-03-17.1 - Frank 2008-03-18 15:15:03.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.950.1.1028.18.164 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: /killall

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((   Files Created from 2008-02-18 to 2008-03-18  )))))))))))))))))))))))))))))))))
.

2008-03-18 14:53 . 2008-01-12 18:32	23,904	–a——	C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-18 14:53 . 2008-01-15 09:54	10,537	–a——	C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-18 14:53 . 2008-01-15 05:28	706	–a——	C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-18 13:04 . 2008-03-18 13:04		d——–	C:\Documents and Settings\Frank\Application Data\Symantec
2008-03-18 12:35 . 2008-03-18 12:35		d——–	C:\WINDOWS\system32\Kaspersky Lab
2008-03-18 12:35 . 2008-03-18 12:35		d——–	C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-18 12:22 . 2008-03-17 14:16		d——–	C:\Documents and Settings\Administrator\Desktop
2008-03-18 12:22 . 2008-03-17 14:16		dr——-	C:\Documents and Settings\Administrator\Start Menu
2008-03-18 12:14 . 2008-03-18 12:14		d——–	C:\Program Files\Trend Micro
2008-03-17 20:17 . 2008-03-17 20:17		d——–	C:\Documents and Settings\Frank\Contacts
2008-03-17 20:15 . 2008-03-17 20:15		d—-c—	C:\WINDOWS\system32\DRVSTORE
2008-03-17 20:01 . 2008-03-17 20:12		d–hsc—	C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-17 20:00 . 2008-03-17 20:14		d——–	C:\Program Files\Windows Live
2008-03-17 20:00 . 2008-03-17 20:00		d——–	C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-17 19:57 . 2008-03-18 15:09	1,606	–a——	C:\WINDOWS\system32\PerfStringBackup.TMP
2008-03-17 19:19 . 2006-08-21 02:14	128,896	—–c—	C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-03-17 19:19 . 2006-08-21 02:14	23,040	—–c—	C:\WINDOWS\system32\dllcache\fltmc.exe
2008-03-17 19:19 . 2006-08-21 05:27	16,896	—–c—	C:\WINDOWS\system32\dllcache\fltlib.dll
2008-03-17 18:22 . 2007-07-09 06:11	584,192	—–c—	C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-17 17:49 . 2008-03-17 17:49	16	–a——	C:\WINDOWS\system32\coh.cache
2008-03-17 17:41 . 2008-03-17 17:41		d——–	C:\Documents and Settings\Frank\Application Data\ContentGuard
2008-03-17 17:39 . 2008-03-17 17:39		d——–	C:\Program Files\Common Files\Zinio
2008-03-17 17:39 . 2008-03-16 11:54	113,859	-r-hs—-	C:\i8.com
2008-03-17 17:39 . 2008-03-18 14:57	502	-r-hs—-	C:\autorun.inf
2008-03-17 17:38 . 2008-03-17 17:40		d——–	C:\Program Files\Zinio
2008-03-17 17:10 . 2008-03-17 19:33		d–h—–	C:\WINDOWS\$hf_mig$
2008-03-17 16:31 . 2008-03-18 15:02		d——–	C:\Program Files\Norton 360
2008-03-17 16:29 . 2008-03-17 17:18		d——–	C:\Program Files\Symantec
2008-03-17 16:29 . 2008-03-18 14:53		d——–	C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-17 16:29 . 2008-03-17 17:18	123,952	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-17 16:29 . 2008-03-17 17:18	60,800	–a——	C:\WINDOWS\system32\S32EVNT1.DLL
2008-03-17 16:29 . 2008-03-17 17:18	10,740	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-17 16:29 . 2008-03-17 17:18	805	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-17 16:27 . 2008-03-18 14:29		d——–	C:\Program Files\Common Files\Symantec Shared
2008-03-17 16:23 . 2008-03-17 16:23		d——–	C:\Program Files\Windows Media Connect 2
2008-03-17 16:23 . 2006-10-04 07:06	1,197,294	—–c—	C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-03-17 16:23 . 2006-10-04 07:06	764,868	—–c—	C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-03-17 16:23 . 2006-10-04 07:06	217,118	—–c—	C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-03-17 16:21 . 2003-06-18 02:31	17,920	–a——	C:\WINDOWS\system32\mdimon.dll
2008-03-17 16:21 . 2008-03-17 16:21	379	–a——	C:\WINDOWS\ODBC.INI
2008-03-17 16:19 . 2008-03-17 16:19		d——–	C:\WINDOWS\system32\LogFiles
2008-03-17 16:19 . 2008-03-17 16:21		d——–	C:\WINDOWS\system32\drivers\UMDF
2008-03-17 16:18 . 2008-03-17 16:18		d——–	C:\Program Files\Microsoft ActiveSync
2008-03-17 16:17 . 2008-03-17 16:18		d——–	C:\WINDOWS\SHELLNEW
2008-03-17 16:15 . 2008-03-17 16:15		dr-h—–	C:\MSOCache
2008-03-17 16:13 . 2007-07-30 04:19	43,352	–a——	C:\WINDOWS\system32\wups2.dll
2008-03-17 16:13 . 2007-07-30 04:20	30,040	–a——	C:\WINDOWS\system32\wucltui.dll.mui
2008-03-17 16:13 . 2007-07-30 04:19	25,944	–a——	C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-17 16:13 . 2007-07-30 04:19	25,944	–a——	C:\WINDOWS\system32\wuapi.dll.mui
2008-03-17 16:13 . 2007-07-30 04:19	16,216	–a——	C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-17 16:12 . 2008-03-17 16:12		d—s—-	C:\Documents and Settings\Frank\UserData
2008-03-17 16:07 . 2008-03-17 16:07		d——–	C:\Documents and Settings\LocalService\Start Menu
2008-03-17 15:57 . 2008-03-17 16:08	316,640	–a——	C:\WINDOWS\WMSysPr9.prx
2008-03-17 15:52 . 2008-03-17 15:52		d——–	C:\WINDOWS\ServicePackFiles
2008-03-17 15:46 . 2004-07-16 20:40	19,528	–a——	C:\WINDOWS\002289_.tmp
2008-03-17 15:44 . 2006-09-25 02:58	23,856	–a——	C:\WINDOWS\system32\spupdsvc.exe
2008-03-17 15:39 . 2008-03-17 15:56		d——–	C:\WINDOWS\EHome
2008-03-17 15:38 . 2008-03-17 20:26		d——–	C:\Documents and Settings\Frank\Application Data\skypePM
2008-03-17 15:38 . 2008-03-17 15:38	32	–a——	C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-17 15:37 . 2008-03-18 15:07		d——–	C:\Documents and Settings\Frank\Application Data\Skype
2008-03-17 15:35 . 2008-03-17 15:45		d——–	C:\Program Files\Skype
2008-03-17 15:35 . 2008-03-17 15:35		d——–	C:\Program Files\Common Files\Skype
2008-03-17 15:34 . 2008-03-17 15:35		d——–	C:\Documents and Settings\All Users\Application Data\Skype
2008-03-17 15:11 . 2008-03-17 15:11		d——–	C:\Program Files\Common Files\Adobe

.
((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 21:42	———	d–h–w	C:\Program Files\InstallShield Installation Information
2008-03-17 21:42	———	d—–w	C:\Program Files\Common Files\InstallShield
2008-03-17 21:42	———	d—–w	C:\Program Files\ANI
2008-03-17 21:41	———	d—–w	C:\Program Files\D-Link
2008-03-17 21:31	———	d—–w	C:\Program Files\microsoft frontpage
.
Files Infected -  Win32.Agent.zb
.

(((((((((((((((((((((((((((((   snapshot@2008-03-18_15.10.20.43   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-18 19:30:32	39,992	—-a-w	C:\WINDOWS\system32\perfc009.dat
+ 2008-03-18 22:09:45	39,992	—-a-w	C:\WINDOWS\system32\perfc009.dat
- 2008-03-18 19:30:32	311,604	—-a-w	C:\WINDOWS\system32\perfh009.dat
+ 2008-03-18 22:09:45	311,604	—-a-w	C:\WINDOWS\system32\perfh009.dat
- 2008-03-18 19:30:32	42,290	—-a-w	C:\WINDOWS\system32\prfc0404.dat
+ 2008-03-18 22:09:45	42,406	—-a-w	C:\WINDOWS\system32\prfc0404.dat
- 2008-03-18 19:30:32	130,958	—-a-w	C:\WINDOWS\system32\prfh0404.dat
+ 2008-03-18 22:09:45	131,180	—-a-w	C:\WINDOWS\system32\prfh0404.dat
+ 2008-03-18 22:23:00	16,384	—-atw	C:\WINDOWS\TEMP\Perflib_Perfdata_e50.dat
.
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* empty entries & legit default entries are not shown 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 09:47 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 02:22 21898024]
"Zinio DLM"="C:\Program Files\Zinio\ZinioReader.exe" [2008-01-18 10:00 3760198]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-17 20:35 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 07:32 208952]
"PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 09:48 455168]
"PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 09:48 455168]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2004-11-18 18:15 1216512]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-21 22:42 45056]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 07:16 39792]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 14:59 115816]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 02:38 583048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 09:47 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4879cf6-f46a-11dc-912e-0050bf915b4b}]
\Shell\AutoRun\command - F:\i8.com
\Shell\explore\Command - F:\i8.com
\Shell\open\Command - F:\i8.com

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-18 15:21:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes … 

scanning hidden autostart entries …

scanning hidden files … 

scan completed successfully 
hidden files: 0 

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 2008-03-18 15:32:07 - machine was rebooted
ComboFix-quarantined-files.txt  2008-03-18 22:31:39
ComboFix2.txt  2008-03-18 22:11:54

4.) And this is my new HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51, on 2008-03-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Zinio\ZinioReader.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZinioReader.exe /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205795577245
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 5339 bytes

I found that my ComboFix.txt is rather different from others, and I am not sure if it is normal since my log does not produce "FILE" or "OTHER DELETIONS" sections in the beginning of the log. But other than that, I am looking for further guidance on what to insert into CFScript.txt in order to continue with the next steps.

Hopefully someone can guide me on this soon. Thanks!

Scotty

Post #2March 26, 2008, 2:27 PM UTC

Hello and welcome to the forum.

Sorry about the delay in responding

If you still need help, Scan again with HijackThis, and "copy/paste" a new log file into this thread.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Also please describe how your computer behaves at the moment.

abcdefGARY

Post #3March 26, 2008, 7:34 PM UTC

Hi, no problem. Thanks for the reply. None of the Kavo.exe and Tavo.exe messages are popping up now when I start my computer… which is a good sign I think/hope. But I want to make sure that there's nothing else living inside my computer.

Here is my new HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:28, on 2008-03-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Zinio\ZinioReader.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZinioReader.exe /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205795577245
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 5148 bytes

And here is the list from my uninstall manager:

Adobe Flash Player Plugin
Adobe Reader 8.1.2 - Chinese Traditional
Adobe Shockwave Player
AirPlus G
ANIO Service
ANIWZCS2 Service
AppCore
AV
ccCommon
GearDrvs
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB926239)
Kaspersky Online Scanner
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Mozilla Firefox (2.0.0.13)
Norton 360
Norton 360
Norton 360
Norton 360 (Symantec Corporation)
Norton 360 Help
Norton Confidential Browser Component
Norton Confidential Web Authentification Component
Norton Confidential Web Protection Component
Skype? 3.6
SPBBC 32bit
SuppSoft
Symantec Technical Support Controls
SymNet
Windows Installer 3.1 (KB893803)
Windows Live installer
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Media Player 11 Hotfix (KB939683)
Windows Media Player 11 Security Update (KB936782)
Windows Media Player 6.4 Security Update (KB925398)
Windows Media Player Security Update (KB911564)
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB886677
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Security Update (KB890046)
Windows XP Security Update (KB893756)
Windows XP Security Update (KB896358)
Windows XP Security Update (KB896423)
Windows XP Security Update (KB896428)
Windows XP Security Update (KB899587)
Windows XP Security Update (KB899591)
Windows XP Security Update (KB900725)
Windows XP Security Update (KB901017)
Windows XP Security Update (KB901190)
Windows XP Security Update (KB901214)
Windows XP Security Update (KB902400)
Windows XP Security Update (KB905414)
Windows XP Security Update (KB905749)
Windows XP Security Update (KB908519)
Windows XP Security Update (KB911562)
Windows XP Security Update (KB911927)
Windows XP Security Update (KB913580)
Windows XP Security Update (KB914388)
Windows XP Security Update (KB914389)
Windows XP Security Update (KB917344)
Windows XP Security Update (KB918118)
Windows XP Security Update (KB918439)
Windows XP Security Update (KB919007)
Windows XP Security Update (KB920213)
Windows XP Security Update (KB920670)
Windows XP Security Update (KB920683)
Windows XP Security Update (KB920685)
Windows XP Security Update (KB922819)
Windows XP Security Update (KB923191)
Windows XP Security Update (KB923414)
Windows XP Security Update (KB923789)
Windows XP Security Update (KB923980)
Windows XP Security Update (KB924270)
Windows XP Security Update (KB924496)
Windows XP Security Update (KB924667)
Windows XP Security Update (KB925902)
Windows XP Security Update (KB926255)
Windows XP Security Update (KB926436)
Windows XP Security Update (KB927779)
Windows XP Security Update (KB927802)
Windows XP Security Update (KB928255)
Windows XP Security Update (KB928843)
Windows XP Security Update (KB929123)
Windows XP Security Update (KB930178)
Windows XP Security Update (KB931261)
Windows XP Security Update (KB931784)
Windows XP Security Update (KB932168)
Windows XP Security Update (KB933729)
Windows XP Security Update (KB935839)
Windows XP Security Update (KB935840)
Windows XP Security Update (KB936021)
Windows XP Security Update (KB937894)
Windows XP Security Update (KB938127)
Windows XP Security Update (KB938829)
Windows XP Security Update (KB941202)
Windows XP Security Update (KB941568)
Windows XP Security Update (KB941569)
Windows XP Security Update (KB941644)
Windows XP Security Update (KB943055)
Windows XP Security Update (KB943460)
Windows XP Security Update (KB943485)
Windows XP Security Update (KB944533)
Windows XP Security Update (KB944653)
Windows XP Security Update (KB946026)
Windows XP Service Pack 2
Windows XP Update (KB894391)
Windows XP Update (KB898461)
Windows XP Update (KB900485)
Windows XP Update (KB908531)
Windows XP Update (KB910437)
Windows XP Update (KB911280)
Windows XP Update (KB916595)
Windows XP Update (KB920872)
Windows XP Update (KB922582)
Windows XP Update (KB927891)
Windows XP Update (KB930916)
Windows XP Update (KB936357)
Windows XP Update (KB938828)
Windows XP Update (KB942763)
Windows XP Update (KB942840)
Zinio Reader

Thanks again!

Scotty

Post #4March 27, 2008, 9:54 AM UTC

Hi

Firstly, delete the copy of Combofix.exe from your Desktop.

Download Flash_Disinfector from here and save it to your desktop.
Doubleclick on Flash_Disinfector.exe to run it and follow the prompts.
Wait until it has finished scanning and then exit the program.
The utility may ask you to insert your flash drive and/or other removable drives. This may include your mobile phone.
Please do so and allow the utility to clean up those drives as well.

If you already have Combofix, please delete that copy and download it again as it's being updated regularly.

Please download Combofix from Bleeping Computer.

If you can't download it from there, please try these 2 alternative sites:

Forospyware
Geeks to Go

Save it to your Desktop.
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed until the scan is complete. This includes your anti-virus. Once you have installed the Scanner, and the updated definitions, you can disconnect from the Internet.Re-enable the anti-virus before reconnecting to the Internet.

In your next reply post:
ComboFix.txt
Kaspersky log
New HijackThis log taken after the above scan has run

abcdefGARY

Post #5March 28, 2008, 10:25 PM UTC last edited March 30, 2008, 8:24 PM UTC

Alright. Here is my ComboFix log:

ComboFix 08-03-27.1 - Frank 2008-03-29  3:29:32.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.950.1.1028.18.123 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: /killall
 * Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
– Script messages for sUBs –

C:\WINDOWS\system32\conime.exe 

((((((((((((((((((((((((((((   Files Created from 2008-02-28 to 2008-03-28  )))))))))))))))))))))))))))))))))
.

2008-03-19 09:37 . 2007-07-31 10:19	271,224	–a——	C:\WINDOWS\system32\mucltui.dll
2008-03-19 09:37 . 2007-07-31 10:19	207,736	–a——	C:\WINDOWS\system32\muweb.dll
2008-03-19 09:37 . 2007-07-31 10:18	25,976	–a——	C:\WINDOWS\system32\mucltui.dll.mui
2008-03-19 05:53 . 2008-03-06 21:32	23,904	–a——	C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-19 05:53 . 2008-03-06 21:32	10,537	–a——	C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-19 05:53 . 2008-03-06 21:32	706	–a——	C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-19 04:04 . 2008-03-19 04:04		d——–	C:\Documents and Settings\Frank\Application Data\Symantec
2008-03-19 03:35 . 2008-03-19 03:35		d——–	C:\WINDOWS\system32\Kaspersky Lab
2008-03-19 03:35 . 2008-03-19 03:35		d——–	C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-19 03:22 . 2008-03-18 05:16		d——–	C:\Documents and Settings\Administrator\Desktop
2008-03-19 03:22 . 2008-03-18 05:16		dr——-	C:\Documents and Settings\Administrator\Start Menu
2008-03-19 03:14 . 2008-03-19 03:14		d——–	C:\Program Files\Trend Micro
2008-03-18 11:17 . 2008-03-18 11:17		d——–	C:\Documents and Settings\Frank\Contacts
2008-03-18 11:15 . 2008-03-18 11:15		d—-c—	C:\WINDOWS\system32\DRVSTORE
2008-03-18 11:01 . 2008-03-18 11:12		d–hsc—	C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-18 11:00 . 2008-03-18 11:14		d——–	C:\Program Files\Windows Live
2008-03-18 11:00 . 2008-03-18 11:00		d——–	C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-18 10:57 . 2008-03-23 01:00	1,606	–a——	C:\WINDOWS\system32\PerfStringBackup.TMP
2008-03-18 10:19 . 2006-08-21 17:14	128,896	—–c—	C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-03-18 10:19 . 2006-08-21 17:14	23,040	—–c—	C:\WINDOWS\system32\dllcache\fltmc.exe
2008-03-18 10:19 . 2006-08-21 20:27	16,896	—–c—	C:\WINDOWS\system32\dllcache\fltlib.dll
2008-03-18 09:22 . 2007-07-09 21:11	584,192	—–c—	C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-18 08:49 . 2008-03-18 08:49	16	–a——	C:\WINDOWS\system32\coh.cache
2008-03-18 08:41 . 2008-03-29 01:34		d——–	C:\Documents and Settings\Frank\Application Data\ContentGuard
2008-03-18 08:39 . 2008-03-18 08:39		d——–	C:\Program Files\Common Files\Zinio
2008-03-18 08:38 . 2008-03-18 08:40		d——–	C:\Program Files\Zinio
2008-03-18 08:10 . 2008-03-18 10:33		d–h—–	C:\WINDOWS\$hf_mig$
2008-03-18 07:31 . 2008-03-23 00:55		d——–	C:\Program Files\Norton 360
2008-03-18 07:29 . 2008-03-18 08:18		d——–	C:\Program Files\Symantec
2008-03-18 07:29 . 2008-03-27 00:30		d——–	C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-18 07:29 . 2008-03-18 08:18	123,952	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-18 07:29 . 2008-03-18 08:18	60,800	–a——	C:\WINDOWS\system32\S32EVNT1.DLL
2008-03-18 07:29 . 2008-03-18 08:18	10,740	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-18 07:29 . 2008-03-18 08:18	805	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-18 07:27 . 2008-03-27 03:25		d——–	C:\Program Files\Common Files\Symantec Shared
2008-03-18 07:23 . 2008-03-18 07:23		d——–	C:\Program Files\Windows Media Connect 2
2008-03-18 07:23 . 2006-10-04 22:06	1,197,294	—–c—	C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-03-18 07:23 . 2006-10-04 22:06	764,868	—–c—	C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-03-18 07:23 . 2006-10-04 22:06	217,118	—–c—	C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-03-18 07:21 . 2003-06-18 17:31	17,920	–a——	C:\WINDOWS\system32\mdimon.dll
2008-03-18 07:21 . 2008-03-18 07:21	379	–a——	C:\WINDOWS\ODBC.INI
2008-03-18 07:19 . 2008-03-18 07:19		d——–	C:\WINDOWS\system32\LogFiles
2008-03-18 07:19 . 2008-03-18 07:21		d——–	C:\WINDOWS\system32\drivers\UMDF
2008-03-18 07:18 . 2008-03-18 07:18		d——–	C:\Program Files\Microsoft ActiveSync
2008-03-18 07:17 . 2008-03-18 07:18		d——–	C:\WINDOWS\SHELLNEW
2008-03-18 07:15 . 2008-03-18 07:15		dr-h—–	C:\MSOCache
2008-03-18 07:13 . 2007-07-30 19:19	43,352	–a——	C:\WINDOWS\system32\wups2.dll
2008-03-18 07:13 . 2007-07-30 19:20	30,040	–a——	C:\WINDOWS\system32\wucltui.dll.mui
2008-03-18 07:13 . 2007-07-30 19:19	25,944	–a——	C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-18 07:13 . 2007-07-30 19:19	25,944	–a——	C:\WINDOWS\system32\wuapi.dll.mui
2008-03-18 07:13 . 2007-07-30 19:19	16,216	–a——	C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-18 07:12 . 2008-03-18 07:12		d—s—-	C:\Documents and Settings\Frank\UserData
2008-03-18 07:07 . 2008-03-18 07:07		d——–	C:\Documents and Settings\LocalService\Start Menu
2008-03-18 06:57 . 2008-03-18 07:08	316,640	–a——	C:\WINDOWS\WMSysPr9.prx
2008-03-18 06:52 . 2008-03-18 06:52		d——–	C:\WINDOWS\ServicePackFiles
2008-03-18 06:46 . 2004-07-17 11:40	19,528	–a——	C:\WINDOWS\002289_.tmp
2008-03-18 06:44 . 2006-09-25 17:58	23,856	–a——	C:\WINDOWS\system32\spupdsvc.exe
2008-03-18 06:39 . 2008-03-18 06:56		d——–	C:\WINDOWS\EHome
2008-03-18 06:38 . 2008-03-29 01:24		d——–	C:\Documents and Settings\Frank\Application Data\skypePM
2008-03-18 06:38 . 2008-03-18 06:38	32	–a——	C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-18 06:37 . 2008-03-29 03:15		d——–	C:\Documents and Settings\Frank\Application Data\Skype
2008-03-18 06:35 . 2008-03-18 06:45		d——–	C:\Program Files\Skype
2008-03-18 06:35 . 2008-03-18 06:35		d——–	C:\Program Files\Common Files\Skype
2008-03-18 06:34 . 2008-03-18 06:35		d——–	C:\Documents and Settings\All Users\Application Data\Skype
2008-03-18 06:11 . 2008-03-18 06:11		d——–	C:\Program Files\Common Files\Adobe

.
((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 21:42	———	d–h–w	C:\Program Files\InstallShield Installation Information
2008-03-17 21:42	———	d—–w	C:\Program Files\Common Files\InstallShield
2008-03-17 21:42	———	d—–w	C:\Program Files\ANI
2008-03-17 21:41	———	d—–w	C:\Program Files\D-Link
2008-03-17 21:31	———	d—–w	C:\Program Files\microsoft frontpage
.

(((((((((((((((((((((((((((((   snapshot@2008-03-18_15.10.20.43   )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 15:00:00	163,328	—-a-w	C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2000-08-31 00:00:00	163,328	—-a-w	C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
- 2000-08-31 15:00:00	28,160	—-a-w	C:\WINDOWS\Nircmd.exe
+ 2000-08-31 00:00:00	28,160	—-a-w	C:\WINDOWS\Nircmd.exe
- 2008-03-18 19:30:32	39,992	—-a-w	C:\WINDOWS\system32\perfc009.dat
+ 2008-03-22 17:00:34	39,992	—-a-w	C:\WINDOWS\system32\perfc009.dat
- 2008-03-18 19:30:32	311,604	—-a-w	C:\WINDOWS\system32\perfh009.dat
+ 2008-03-22 17:00:34	311,604	—-a-w	C:\WINDOWS\system32\perfh009.dat
- 2008-03-18 19:30:32	42,290	—-a-w	C:\WINDOWS\system32\prfc0404.dat
+ 2008-03-22 17:00:34	42,870	—-a-w	C:\WINDOWS\system32\prfc0404.dat
- 2008-03-18 19:30:32	130,958	—-a-w	C:\WINDOWS\system32\prfh0404.dat
+ 2008-03-22 17:00:34	132,068	—-a-w	C:\WINDOWS\system32\prfh0404.dat
- 2000-08-31 15:00:00	161,792	—-a-w	C:\WINDOWS\system32\swreg.exe
+ 2000-08-31 00:00:00	161,792	—-a-w	C:\WINDOWS\system32\swreg.exe
+ 2008-03-28 19:35:49	16,384	—-atw	C:\WINDOWS\TEMP\Perflib_Perfdata_b48.dat
.
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* empty entries & legit default entries are not shown 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:47 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
"Zinio DLM"="C:\Program Files\Zinio\ZinioReader.exe" [2008-01-19 01:00 3760198]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:35 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 22:32 208952]
"PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 00:48 455168]
"PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 00:48 455168]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2004-11-19 09:15 1216512]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-22 13:42 45056]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 05:59 115816]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:47 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=


*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 03:34:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes … 

scanning hidden autostart entries …

scanning hidden files … 

scan completed successfully  
hidden files: 0 

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2008-03-29  3:41:58 - machine was rebooted
ComboFix-quarantined-files.txt  2008-03-28 19:41:40
ComboFix2.txt  2008-03-18 22:32:09
ComboFix3.txt  2008-03-18 22:11:54
			   5 個目錄   2,376,347,648 位元組可用
			   9 個目錄   2,369,499,136 位元組可用

Here is my Kaspersky Scan results:

——————————————————————————-
 KASPERSKY ONLINE SCANNER REPORT
 Saturday, March 29, 2008 6:22:32 AM
 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
 Kaspersky Online Scanner version: 5.0.98.0
 Kaspersky Anti-Virus database last update: 28/03/2008
 Kaspersky Anti-Virus database records: 668934
——————————————————————————-

Scan Settings:
	Scan using the following antivirus database: extended
	Scan Archives: true
	Scan Mail Bases: true

Scan Target - My Computer:
	A:\
	C:\
	D:\
	E:\

Scan Statistics:
	Total number of scanned objects: 26018
	Number of viruses found: 6
	Number of infected objects: 33
	Number of suspicious objects: 0
	Duration of the scan process: 01:20:22

Infected Object Name / Virus Name / Last Action
C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\54BEF0E5.TMP	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\contactgroup256.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\dyncontent\bundle.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\index2.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\profile4096.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\user1024.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\user256.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows Live Contacts\[My Email Address]\real\members.stg	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows Live Contacts\[My Email Address]\shadow\members.stg	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\History\History.IE5\MSHist012008032920080330\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF1413.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF1433.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF5727.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temp\~DF5740.tmp	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\Frank\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAD.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWADMT.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.ldb	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AutoProtect.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AVContext.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AVManual.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\Backup.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetPageViewHistory.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetSearchHistory.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetTempFiles.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUWindowsTempFiles.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\EmailScan.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\InternetSecurity.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISIntrusionPrevented.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISIOTraffic.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISNewNetwork.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\LiveUpdate.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\NCO.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VABrowserSettings.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VAIPAddresses.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VAWeakPasswords.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\WDFScanner.log	Object is locked	skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kavo.exe.vir	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kavo0.dll.vir	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tavo.exe.vir	Infected: Trojan-PSW.Win32.OnLineGames.vkh	skipped
C:\System Volume Information\MountPointManagerRemoteDatabase	Object is locked	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0003957.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar/xpkey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar/officekey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe	RAR: infected - 4	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004452.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004453.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP16\A0004456.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004462.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004473.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004474.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004482.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004483.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004491.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004492.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004499.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004500.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004501.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004507.dll	Infected: Trojan-PSW.Win32.OnLineGames.xkb	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004521.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004522.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004523.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004525.exe	Infected: Trojan-PSW.Win32.OnLineGames.wfp	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004545.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004549.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004550.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004551.exe	Infected: Trojan-PSW.Win32.OnLineGames.vkh	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004615.dll	Infected: Trojan-PSW.Win32.OnLineGames.vki	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004775.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP19\change.log	Object is locked	skipped
C:\WINDOWS\Debug\PASSWD.LOG	Object is locked	skipped
C:\WINDOWS\SchedLgU.Txt	Object is locked	skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{F6A5B4C2-A442-47DB-96AF-215B5AECAF96}.bin	Object is locked	skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\edb.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb	Object is locked	skipped
C:\WINDOWS\system32\config\AppEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\default	Object is locked	skipped
C:\WINDOWS\system32\config\default.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SAM	Object is locked	skipped
C:\WINDOWS\system32\config\SAM.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SecEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\software	Object is locked	skipped
C:\WINDOWS\system32\config\software.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SysEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\system	Object is locked	skipped
C:\WINDOWS\system32\config\system.LOG	Object is locked	skipped
C:\WINDOWS\system32\drivers\etc\Hosts.bak	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	Object is locked	skipped
C:\WINDOWS\TEMP\JET77.tmp	Object is locked	skipped
C:\WINDOWS\TEMP\JETFEFA.tmp	Object is locked	skipped
C:\WINDOWS\WindowsUpdate.log	Object is locked	skipped

Scan process completed.

and I scanned once again with HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:23, on 2008-03-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Zinio\ZinioReader.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZinioReader.exe /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205795577245
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 5210 bytes

Thanks again.

Scotty

Post #6March 29, 2008, 9:17 AM UTC

Hi

We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System, which in your case is SP2

XP Media Centre is based upon XP Professional

[external image: Posted Image]

Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

abcdefGARY

Post #7March 29, 2008, 6:36 PM UTC

ok… a short one this time:

WindowsXP-KB310994-SP2-Pro-BootDisk-CHT.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

Scotty

Post #8March 29, 2008, 9:07 PM UTC

Hi

Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

KillAll::
 
File::
C:\WINDOWS\system32\coh.cache
C:\WINDOWS\WMSysPr9.prx

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Post that log back here.

In your next reply post:
ComboFix.txt
MBAM log
New HijackThis log taken after the above scans have run

abcdefGARY

Post #9March 30, 2008, 1:18 AM UTC

Okay. Here is the ComboFix log (Excuse the Chinese labels, I tried to translate as much as possible):

ComboFix 08-03-27.1 - Frank 2008-03-30  6:17:47.4 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.950.1.1028.18.164 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Frank\Desktop\CFScript.txt
 * Created a new restore point

FILE ::
C:\WINDOWS\system32\coh.cache
C:\WINDOWS\WMSysPr9.prx
.
– Script messages for sUBs –

C:\WINDOWS\system32\conime.exe 

((((((((((((((((((((((((((((((((((((((   其他遭刪除的檔案 (Other deleted files)   ))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\coh.cache
C:\WINDOWS\WMSysPr9.prx

.
((((((((((((((((((((((((((((   Files Created from 2008-02-28 to 2008-03-29  )))))))))))))))))))))))))))))))))
.

2008-03-19 09:37 . 2007-07-31 10:19	271,224	–a——	C:\WINDOWS\system32\mucltui.dll
2008-03-19 09:37 . 2007-07-31 10:19	207,736	–a——	C:\WINDOWS\system32\muweb.dll
2008-03-19 09:37 . 2007-07-31 10:18	25,976	–a——	C:\WINDOWS\system32\mucltui.dll.mui
2008-03-19 05:53 . 2008-03-06 21:32	23,904	–a——	C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-19 05:53 . 2008-03-06 21:32	10,537	–a——	C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-19 05:53 . 2008-03-06 21:32	706	–a——	C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-19 04:04 . 2008-03-19 04:04		d——–	C:\Documents and Settings\Frank\Application Data\Symantec
2008-03-19 03:35 . 2008-03-19 03:35		d——–	C:\WINDOWS\system32\Kaspersky Lab
2008-03-19 03:35 . 2008-03-19 03:35		d——–	C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-19 03:22 . 2008-03-18 05:16		d——–	C:\Documents and Settings\Administrator\Desktop
2008-03-19 03:22 . 2008-03-18 05:16		dr——-	C:\Documents and Settings\Administrator\Start Menu
2008-03-19 03:14 . 2008-03-19 03:14		d——–	C:\Program Files\Trend Micro
2008-03-18 11:17 . 2008-03-18 11:17		d——–	C:\Documents and Settings\Frank\Contacts
2008-03-18 11:15 . 2008-03-18 11:15		d—-c—	C:\WINDOWS\system32\DRVSTORE
2008-03-18 11:01 . 2008-03-18 11:12		d–hsc—	C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-18 11:00 . 2008-03-18 11:14		d——–	C:\Program Files\Windows Live
2008-03-18 11:00 . 2008-03-18 11:00		d——–	C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-18 10:57 . 2008-03-23 01:00	1,606	–a——	C:\WINDOWS\system32\PerfStringBackup.TMP
2008-03-18 10:19 . 2006-08-21 17:14	128,896	—–c—	C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-03-18 10:19 . 2006-08-21 17:14	23,040	—–c—	C:\WINDOWS\system32\dllcache\fltmc.exe
2008-03-18 10:19 . 2006-08-21 20:27	16,896	—–c—	C:\WINDOWS\system32\dllcache\fltlib.dll
2008-03-18 09:22 . 2007-07-09 21:11	584,192	—–c—	C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-18 08:41 . 2008-03-29 01:34		d——–	C:\Documents and Settings\Frank\Application Data\ContentGuard
2008-03-18 08:39 . 2008-03-18 08:39		d——–	C:\Program Files\Common Files\Zinio
2008-03-18 08:38 . 2008-03-18 08:40		d——–	C:\Program Files\Zinio
2008-03-18 08:10 . 2008-03-18 10:33		d–h—–	C:\WINDOWS\$hf_mig$
2008-03-18 07:31 . 2008-03-23 00:55		d——–	C:\Program Files\Norton 360
2008-03-18 07:29 . 2008-03-18 08:18		d——–	C:\Program Files\Symantec
2008-03-18 07:29 . 2008-03-29 04:23		d——–	C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-18 07:29 . 2008-03-18 08:18	123,952	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-18 07:29 . 2008-03-18 08:18	60,800	–a——	C:\WINDOWS\system32\S32EVNT1.DLL
2008-03-18 07:29 . 2008-03-18 08:18	10,740	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-18 07:29 . 2008-03-18 08:18	805	–a——	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-18 07:27 . 2008-03-27 03:25		d——–	C:\Program Files\Common Files\Symantec Shared
2008-03-18 07:23 . 2008-03-18 07:23		d——–	C:\Program Files\Windows Media Connect 2
2008-03-18 07:23 . 2006-10-04 22:06	1,197,294	—–c—	C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-03-18 07:23 . 2006-10-04 22:06	764,868	—–c—	C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-03-18 07:23 . 2006-10-04 22:06	217,118	—–c—	C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-03-18 07:21 . 2003-06-18 17:31	17,920	–a——	C:\WINDOWS\system32\mdimon.dll
2008-03-18 07:21 . 2008-03-18 07:21	379	–a——	C:\WINDOWS\ODBC.INI
2008-03-18 07:19 . 2008-03-18 07:19		d——–	C:\WINDOWS\system32\LogFiles
2008-03-18 07:19 . 2008-03-18 07:21		d——–	C:\WINDOWS\system32\drivers\UMDF
2008-03-18 07:18 . 2008-03-18 07:18		d——–	C:\Program Files\Microsoft ActiveSync
2008-03-18 07:17 . 2008-03-18 07:18		d——–	C:\WINDOWS\SHELLNEW
2008-03-18 07:15 . 2008-03-18 07:15		dr-h—–	C:\MSOCache
2008-03-18 07:13 . 2007-07-30 19:19	43,352	–a——	C:\WINDOWS\system32\wups2.dll
2008-03-18 07:13 . 2007-07-30 19:20	30,040	–a——	C:\WINDOWS\system32\wucltui.dll.mui
2008-03-18 07:13 . 2007-07-30 19:19	25,944	–a——	C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-18 07:13 . 2007-07-30 19:19	25,944	–a——	C:\WINDOWS\system32\wuapi.dll.mui
2008-03-18 07:13 . 2007-07-30 19:19	16,216	–a——	C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-18 07:12 . 2008-03-18 07:12		d—s—-	C:\Documents and Settings\Frank\UserData
2008-03-18 07:07 . 2008-03-18 07:07		d——–	C:\Documents and Settings\LocalService\Start Menu
2008-03-18 06:52 . 2008-03-18 06:52		d——–	C:\WINDOWS\ServicePackFiles
2008-03-18 06:46 . 2004-07-17 11:40	19,528	–a——	C:\WINDOWS\002289_.tmp
2008-03-18 06:44 . 2006-09-25 17:58	23,856	–a——	C:\WINDOWS\system32\spupdsvc.exe
2008-03-18 06:39 . 2008-03-18 06:56		d——–	C:\WINDOWS\EHome
2008-03-18 06:38 . 2008-03-30 02:28		d——–	C:\Documents and Settings\Frank\Application Data\skypePM
2008-03-18 06:38 . 2008-03-18 06:38	32	–a——	C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-18 06:37 . 2008-03-30 05:51		d——–	C:\Documents and Settings\Frank\Application Data\Skype
2008-03-18 06:35 . 2008-03-18 06:45		d——–	C:\Program Files\Skype
2008-03-18 06:35 . 2008-03-18 06:35		d——–	C:\Program Files\Common Files\Skype
2008-03-18 06:34 . 2008-03-18 06:35		d——–	C:\Documents and Settings\All Users\Application Data\Skype
2008-03-18 06:11 . 2008-03-18 06:11		d——–	C:\Program Files\Common Files\Adobe

.
((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 21:42	———	d–h–w	C:\Program Files\InstallShield Installation Information
2008-03-17 21:42	———	d—–w	C:\Program Files\Common Files\InstallShield
2008-03-17 21:42	———	d—–w	C:\Program Files\ANI
2008-03-17 21:41	———	d—–w	C:\Program Files\D-Link
2008-03-17 21:31	———	d—–w	C:\Program Files\microsoft frontpage
.

(((((((((((((((((((((((((((((   snapshot@2008-03-18_15.10.20.43   )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 15:00:00	163,328	—-a-w	C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2000-08-31 00:00:00	163,328	—-a-w	C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
- 2000-08-31 15:00:00	28,160	—-a-w	C:\WINDOWS\Nircmd.exe
+ 2000-08-31 00:00:00	28,160	—-a-w	C:\WINDOWS\Nircmd.exe
- 2008-03-18 19:30:32	39,992	—-a-w	C:\WINDOWS\system32\perfc009.dat
+ 2008-03-22 17:00:34	39,992	—-a-w	C:\WINDOWS\system32\perfc009.dat
- 2008-03-18 19:30:32	311,604	—-a-w	C:\WINDOWS\system32\perfh009.dat
+ 2008-03-22 17:00:34	311,604	—-a-w	C:\WINDOWS\system32\perfh009.dat
- 2008-03-18 19:30:32	42,290	—-a-w	C:\WINDOWS\system32\prfc0404.dat
+ 2008-03-22 17:00:34	42,870	—-a-w	C:\WINDOWS\system32\prfc0404.dat
- 2008-03-18 19:30:32	130,958	—-a-w	C:\WINDOWS\system32\prfh0404.dat
+ 2008-03-22 17:00:34	132,068	—-a-w	C:\WINDOWS\system32\prfh0404.dat
- 2000-08-31 15:00:00	161,792	—-a-w	C:\WINDOWS\system32\swreg.exe
+ 2000-08-31 00:00:00	161,792	—-a-w	C:\WINDOWS\system32\swreg.exe
.
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* empty entries & legit default entries are not shown 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:47 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
"Zinio DLM"="C:\Program Files\Zinio\ZinioReader.exe" [2008-01-19 01:00 3760198]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:35 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 22:32 208952]
"PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 00:48 455168]
"PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 00:48 455168]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2004-11-19 09:15 1216512]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-22 13:42 45056]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 05:59 115816]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:47 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=


*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-30 06:23:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes … 

scanning hidden autostart entries …

scanning hidden files … 

scan completed successfully  
hidden files: 0 

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2008-03-30  6:27:50 - machine was rebooted
ComboFix-quarantined-files.txt  2008-03-29 22:27:01
ComboFix2.txt  2008-03-28 19:42:00
ComboFix3.txt  2008-03-18 22:32:09
ComboFix4.txt  2008-03-18 22:11:54
			   6 個目錄   2,408,914,944 位元組可用
			  10 個目錄   2,401,247,232 位元組可用

Log from MBAM:

Malwarebytes' Anti-Malware 1.09
Database version: 567

Scan type: Quick Scan
Objects scanned: 27851
Time elapsed: 6 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

and the log from Hijack This:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:15, on 2008-03-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Zinio\ZinioReader.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\explorer.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZinioReader.exe /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205795577245
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 5279 bytes

thanks.

Scotty

Post #10March 30, 2008, 10:37 AM UTC

Hi

I just need to make sure those files are gone.

1 - FindFile
Download FindFile by Atribune from >here<

Extract the contents to your Desktop
Double click on FileFind.exe to open the program.
Enter tavo.exe into the File: box.
Click on the Search button.
After a while a list of file locations will appear in the List of Files: box.
Click on the Export button.

This will create a Notepad file named Export.txt located in the C:\ folder, copy and paste it to your next post please.

Please repeat the above for kavo.exe

Then run the Kaspersky online scanner again and post the new log it produces.

abcdefGARY

Post #11March 30, 2008, 8:19 PM UTC last edited March 30, 2008, 8:25 PM UTC

Both my FileFind logs came out empty. I don't know if this is correct or not. My Kaspersky scan results are below. Looks like I obtained more viruses and infected files over this period of time… strange.

——————————————————————————-
 KASPERSKY ONLINE SCANNER REPORT
 Monday, March 31, 2008 4:15:07 AM
 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
 Kaspersky Online Scanner version: 5.0.98.0
 Kaspersky Anti-Virus database last update: 30/03/2008
 Kaspersky Anti-Virus database records: 673464
——————————————————————————-

Scan Settings:
	Scan using the following antivirus database: extended
	Scan Archives: true
	Scan Mail Bases: true

Scan Target - My Computer:
	A:\
	C:\
	D:\
	E:\

Scan Statistics:
	Total number of scanned objects: 26714
	Number of viruses found: 7
	Number of infected objects: 35
	Number of suspicious objects: 0
	Duration of the scan process: 01:17:15

Infected Object Name / Virus Name / Last Action
C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\54BEF0E5.TMP	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\contactgroup256.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\dyncontent\bundle.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\index2.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\profile4096.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\user1024.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Application Data\Skype\[My Skype Username]\user256.dbb	Object is locked	skipped
C:\Documents and Settings\Frank\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Application Data\Mozilla\Firefox\Profiles\1vcd4ouk.default\Cache\3E4696B3d01	Infected: not-a-virus:Downloader.Win32.WinFixer.fs	skipped
C:\Documents and Settings\Frank\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\History\History.IE5\MSHist012008033120080401\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\Frank\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\Frank\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Frank\Desktop\Download_mbam-setup.exe	Infected: not-a-virus:Downloader.Win32.WinFixer.fs	skipped
C:\Documents and Settings\LocalService\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAD.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWADMT.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.5\NCOWAS.ldb	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\lulock.dat	Object is locked	skipped
C:\Program Files\Common Files\Symantec Shared\VirusDefs\lulock.dat	Object is locked	skipped
C:\Program Files\Norton 360\Log\AutoProtect.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AVContext.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\AVManual.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\Backup.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetPageViewHistory.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetSearchHistory.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUInternetTempFiles.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\CUWindowsTempFiles.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\EmailScan.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\InternetSecurity.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISIntrusionPrevented.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISIOTraffic.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\ISNewNetwork.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\LiveUpdate.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\NCO.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VABrowserSettings.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VAIPAddresses.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\VAWeakPasswords.log	Object is locked	skipped
C:\Program Files\Norton 360\Log\WDFScanner.log	Object is locked	skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kavo.exe.vir	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\kavo0.dll.vir	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tavo.exe.vir	Infected: Trojan-PSW.Win32.OnLineGames.vkh	skipped
C:\System Volume Information\MountPointManagerRemoteDatabase	Object is locked	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0003957.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar/xpkey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar/officekey.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe/data.rar	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe/keyfinder.exe	Infected: not-a-virus:PSWTool.Win32.RAS.a	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004026.exe	RAR: infected - 4	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004452.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP15\A0004453.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP16\A0004456.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004462.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004473.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004474.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004482.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004483.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004491.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004492.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004499.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004500.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004501.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004507.dll	Infected: Trojan-PSW.Win32.OnLineGames.xkb	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004521.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004522.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004523.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP17\A0004525.exe	Infected: Trojan-PSW.Win32.OnLineGames.wfp	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004545.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004549.exe	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004550.dll	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004551.exe	Infected: Trojan-PSW.Win32.OnLineGames.vkh	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004615.dll	Infected: Trojan-PSW.Win32.OnLineGames.vki	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP18\A0004775.com	Infected: Packed.Win32.PolyCrypt.h	skipped
C:\System Volume Information\_restore{48E807A5-A1C6-4F3E-9B8A-DCF50B0B1E36}\RP21\change.log	Object is locked	skipped
C:\WINDOWS\Debug\PASSWD.LOG	Object is locked	skipped
C:\WINDOWS\SchedLgU.Txt	Object is locked	skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\edb.log	Object is locked	skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb	Object is locked	skipped
C:\WINDOWS\system32\config\AppEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\default	Object is locked	skipped
C:\WINDOWS\system32\config\default.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SAM	Object is locked	skipped
C:\WINDOWS\system32\config\SAM.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SecEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY	Object is locked	skipped
C:\WINDOWS\system32\config\SECURITY.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\software	Object is locked	skipped
C:\WINDOWS\system32\config\software.LOG	Object is locked	skipped
C:\WINDOWS\system32\config\SysEvent.Evt	Object is locked	skipped
C:\WINDOWS\system32\config\system	Object is locked	skipped
C:\WINDOWS\system32\config\system.LOG	Object is locked	skipped
C:\WINDOWS\system32\drivers\etc\Hosts.bak	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	Object is locked	skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	Object is locked	skipped
C:\WINDOWS\TEMP\JET9177.tmp	Object is locked	skipped
C:\WINDOWS\TEMP\JET9697.tmp	Object is locked	skipped
C:\WINDOWS\WindowsUpdate.log	Object is locked	skipped

Scan process completed.

Scotty

Post #12March 30, 2008, 8:26 PM UTC

Hello

Dont worry, that stuff Kaspersky found is in the Combo quarantine and the System Restore points. They will disappear when we remove Combofix, in just a minute.

Congratulations, you appear to be malware free.

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the x and the /u, it needs to be there.

[external image: Posted Image]

You may wish to keep hold of the Kaspersky Online Scan as an extra on-demand virus-scanner.
If not you can uninstall it through Start>Control Panel>Add/Remove Programs

Malwarebytes Anti-Malware is a good program to keep. If you wish to keep it, use it to do a quick scan once a week and keep it updated.
Remember, only the paid for version offers real-time protection

Here is another free program I recommend.

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Here is some great information from experts in this field that will help you stay clean and safe online.
http://forum.malwareremoval.com/viewtopic.php?t=14

Follow this list and your potential for being infected again will reduce dramatically.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

abcdefGARY

Post #13March 30, 2008, 8:32 PM UTC last edited March 30, 2008, 8:33 PM UTC

Okay. I shall do that. Again, thank you so much for your help and this one-on-one service.

You can close this thread now.

Scotty

Post #14March 30, 2008, 8:40 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Removing Tavo.exe and Kavo.exe

✨ Ask AI

Ask AI