What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Infected with SAM virus!

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have been infected with a virus which calls itself SAM. Everytime I try to do something a message pops up from SAM. For eg: When I open Task Manager a message pops up which says:

What's wrong with the processes?
-SAM-

Or when I open Firefox:

Try something else, IE and Opera are not bad!
-SAM-

I have posted a HijackThis! log. Please help me remove this. I think it came from a friend's pen drive which I was using. I had also removed AVG two days ago because it was causing problems. I also got 'You have a large number of hijacked domains' when i used HJT. I think that's caused by the virus too.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:09:29 PM, on 9/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\System32\database.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Eset\nod32krn.exe
C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
C:\Config\system.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads.sify.com/RealMedia/ads/click_lx…ridlog=nadeem_d
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\System32\database.exe,
O1 - Hosts: 127.1 localhost
O1 - Hosts: 127.1 vt0r48p760.cn
O1 - Hosts: 127.1 www.1txx.com
O1 - Hosts: 127.1 www.myovec.cn
O1 - Hosts: 127.1 po.uc-us.cn
O1 - Hosts: 127.1 219.139.83.20
O1 - Hosts: 127.1 www.msj007.cn
O1 - Hosts: 127.1 www.wyf009.cn
O1 - Hosts: 127.1 219.153.71.185
O1 - Hosts: 127.1 59.34.148.68
O1 - Hosts: 127.1 208.43.165.86
O1 - Hosts: 127.1 208.43.166.171
O1 - Hosts: 127.1 219.153.71.185
O1 - Hosts: 127.1 61.164.140.39
O1 - Hosts: 127.1 www.dsabh.cnwww.dsabh.cn
O1 - Hosts: 127.1 cwk1237.3322.org
O1 - Hosts: 127.1 www.woaigan.com
O1 - Hosts: 127.1 munchkin.marketo.net
O1 - Hosts: 127.1 post.marketo.net
O1 - Hosts: 127.1 www.mv2z.cn
O1 - Hosts: 127.1 www.91vva.cn
O1 - Hosts: 127.1 www.wq9q.cn
O1 - Hosts: 127.1 facaizhifuok.cn
O1 - Hosts: 127.1 www.wo9188.cn
O1 - Hosts: 127.1 a.woaigan.com
O1 - Hosts: 127.1 b.woaigan.com
O1 - Hosts: 127.1 xxx.usxx.info
O1 - Hosts: 127.1 alenxya.1122mb.com
O1 - Hosts: 127.1 www.972se.com
O1 - Hosts: 127.1 972se.com
O1 - Hosts: 127.1 pic.03wyt.com
O1 - Hosts: 127.1 d.03wyt.com
O1 - Hosts: 127.1 xs.03wyt.com
O1 - Hosts: 127.1 www.8jse.net
O1 - Hosts: 127.1 8jse.net
O1 - Hosts: 127.1 www.bmwtvb.cn
O1 - Hosts: 127.1 www.kcuf-09.cn
O1 - Hosts: 127.1 www.dvgdfg4650.com
O1 - Hosts: 127.1 www.kcuf-08.cn
O1 - Hosts: 127.1 www.kcuf-11.cn
O1 - Hosts: 127.1 www.kcuf-12.cn
O1 - Hosts: 127.1 1aa1aa.com
O1 - Hosts: 127.1 xx.avno3.com
O1 - Hosts: 127.1 xxx.avno5.com
O1 - Hosts: 127.1 www.avno7.com
O1 - Hosts: 127.1 avno7.com
O1 - Hosts: 127.1 ok.avno4.com
O1 - Hosts: 127.1 ok.avno5.com
O1 - Hosts: 127.1 ok.avno6.com
O1 - Hosts: 127.1 ok.avno7.com
O1 - Hosts: 127.1 ok.avno9.com
O1 - Hosts: 127.1 avno1.com
O1 - Hosts: 127.1 avno3.com
O1 - Hosts: 127.1 avno4.com
O1 - Hosts: 127.1 aikanav.com
O1 - Hosts: 127.1 link.selink.org
O1 - Hosts: 127.1 www.avno6.com
O1 - Hosts: 127.1 avno6.com
O1 - Hosts: 127.1 4.chibbs.info
O1 - Hosts: 127.1 bbs.chibbs.info
O1 - Hosts: 127.1 aa.ss99.biz
O1 - Hosts: 127.1 se.ss99.biz
O1 - Hosts: 127.1 aa.sxlk.net
O1 - Hosts: 127.1 se.sxlk99.com
O1 - Hosts: 127.1 www.88xj.net
O1 - Hosts: 127.1 88xj.net
O1 - Hosts: 127.1 www.99xj.net
O1 - Hosts: 127.1 99xj.net
O1 - Hosts: 127.1 www.91semi.com
O1 - Hosts: 127.1 91semi.com
O1 - Hosts: 127.1 haobaidu.1122mb.com
O1 - Hosts: 127.1 xiao777.za.pl
O1 - Hosts: 127.1 ccavo6.avno6.com
O1 - Hosts: 127.1 a.sxlk99.com
O1 - Hosts: 127.1 www.91vva.cn
O1 - Hosts: 127.1 www.qq08w12.cn
O1 - Hosts: 127.1 www.21xx.info
O1 - Hosts: 127.1 php-1.cn
O1 - Hosts: 127.1 www.v232.com
O1 - Hosts: 127.1 php-2.cn
O1 - Hosts: 127.1 php-3.cn
O1 - Hosts: 127.1 php-4.cn
O1 - Hosts: 127.1 php-5.cn
O1 - Hosts: 127.1 php-6.cn
O1 - Hosts: 127.1 php-7.cn
O1 - Hosts: 127.1 php-8.cn
O1 - Hosts: 127.1 php-9.cn
O1 - Hosts: 127.1 php-10.cn
O1 - Hosts: 127.1 php-11.cn
O1 - Hosts: 127.1 k.5x2x.com
O1 - Hosts: 127.1 a.5x2x.com
O1 - Hosts: 127.1 202.108.23.205
O1 - Hosts: 127.1 60.190.218.21
O1 - Hosts: 127.1 121.14.154.195
O1 - Hosts: 127.1 218.30.82.201
O1 - Hosts: 127.1 59.34.198.48
O1 - Hosts: 127.1 121.14.154.216
O1 - Hosts: 127.1 219.152.120.237
O1 - Hosts: 127.1 121.14.154.184
O1 - Hosts: 127.1 125.67.67.201
O1 - Hosts: 127.1 222.168.102.12
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [winsystem] C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Policies\Explorer\Run: [winlogon] C:\Config\system.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C68DBAE-C4EA-4926-96F9-D52AB013DB77}: NameServer = 202.144.115.4,202.144.66.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EE67727-44D2-4689-A9C7-35FD103115B1}: NameServer = 202.144.115.4,202.144.66.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - AppInit_DLLs: qxfel.dll eskisl.dll micsus.dll cupops.dll jolndyo.dll lensch.dll johandy.dll aotoppt.dll pewire.dll catower.dll wllame.dll,HBmhly.dll,HB1000Y.dll,HBWOOOL.dll,HBXY2.dll,HBJXSJ.dll,HBSO2.dll,HBF
S2.dll,HBXY3.dll,HBSHQ.dll,HBFY.dll,HBWULIN2.dll,HBW2I.dll,HBKDXY.dll,HBWORLD2.dl
l,HBASKTAO.dll,HBZHUXIAN.dll,HBWOW.dll,HBZERO.dll,HBBO.dll,HBCONQUER.dll,HBSOUL.d
ll,HBCHIBI.dll,HBDNF.dll,HBWARLORDS.dll,HBTL.dll,HBPICKCHINA.dll,HBCT.dll,HBGC.dl
l,HBHM.dll,HBHX2.dll,HBQQHX.dll,HBTW2.dll,HBQQSG.dll,HBQQFFO.dll,HBZT.dll,HBMIR2.
dll,HBRXJH.dll,HBYY.dll,HBMXD.dll,HBSQ.dll,HBTJ.dll,HBFHZL.dll,HBWLQX.dll,HBLYFX.
dll,HBR2.dll,HBCHD.dll,HBTZ.dll,HBQQXX.dll,HBWD.dll,HBZG.dll,HBPPBL.dll,HBXMJ.dll
,HBJTLQ.dll,HBQJSJ.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: slbiopfs2.dll - {EB9660D8-E1CD-4ff0-B4A9-00CD907F928A} - (no file)
O21 - SSODL: mstimewd.dll - {65056902-6E7B-4bd7-95BA-688DB5FA5BEB} - (no file)
O21 - SSODL: adsntzt.dll - {E0F3526A-4165-4589-80CD-50B6FBAC3BDA} - (no file)
O21 - SSODL: dispexcb.dll - {76D44356-B494-443a-BEDC-AA68DE4255E6} - (no file)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: DesktopWin - {DA191DE0-AA86-4ED0-4B87-292A3D48BE99} - C:\WINDOWS\AppPatch\DesktopWin.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 10033 bytes
Post #2 last edited
_________________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!

  • Save and quit any work your doing before beginning the fix.
  • All hijackthis logs I ask for should be done in normal mode ( not safe mode)
  • These logs should be done last after you have followed my instructions in the previous post.


Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!





I will be back shortly with some advice. This machine is highly infected.
Post #3

DO NOT PUT YOUR FRIENDS USB STICK BACK IN YOUR MACHINE.

Please take the time to read all I have posted.

______________________________________________________
It looks like you have been infected by a few backdoor trojans.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files .



Its very possible that anything could have been installed on your computer by the remote attacker, including opening other backdoors and installing rootkits. While we can attempt to clean what we see in your logs, we can't guarantee that your computer will be completely in the clear since we have no way of knowing what has been done to the computer. Your computer could be completely compromised at this moment. It may be prudent to backup your information, reformat, and reinstall.

More information on Remote Access Trojans can be found
here

I suggest you do the following immediately:
  • Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
  • From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
  • Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passords and transaction information.

Next problem:
Another Backdoor on your machine is a gaming info stealer. The same rules apply. If you have sensitive information on online gaming sites they need to be changed as well. And done so with a clean machine so the info isn't passed out immediately.



If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can help you clean your computer to the best of my abilities.

Please let me know what you decide to do in your next post.

Should you decide to clean this machine start by doing the following.





_____________________________________
Before we start: Please be aware that removing Malware can be a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop. If you can help it do not use this machine until we have it clean.



In light of this it would be wise for you to back up any files and folders that you don't want to lose before we start.






______________________________


I see you have some disabled programs through Msconfig.
I need you to start everything in there for me before your next HJT log.
This way I can see if anything bad is not showing . Something Malware likes to do.

Click start/run
Type or copy in msconfig
hit enter
Go to the start up tab
Click on enable all.

Restart when your prompted to.

You computer will start a bit slower but once we have you clean you can go through again a disable what you like.













________________________________________

Please download HoxtXpert.
  • Unzip HostsXpert.zip
  • Double click on HostsXpert.exe
  • Then click on "Restore MSl Hosts file" to restore your Hosts file to its default condidtion..
  • Click on Make Hosts Read Only to secure it against further infection.
  • Close program when complete.










_______________________________________________

1. Download Combo fix from one of these locations.
* IMPORTANT !!! Place combofix.exe on your Desktop

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

2. Click start/run and copy and Paste this in exactly using the picture below for reference:

"%userprofile%\desktop\combofix.exe" /killall


[external image: Posted Image]

3. Combo will begin to run DO NOTHING while this is happeneing.
  • It will kill a few processes and disconnect you from the internet.
  • If by chance it stops prematurly you can re-establish your internet connection by restarting your computer.
  • This needs to be done so the program can work most efficiently for you.
Do not attempt to use the internet or anything else while it's doing its job for you.

If when it's completed you can not get on the internet just reboot the computer

Post the log from comboFix for me located in
c:\comboFix.txt




_____________________________
I need to know who your internet service provider is.
Do you know whom SIFY INFRASTRUCTURE[/b is?





_________________________
In your next reply I would like to see:
  • A new HJT log
  • The report from ComboFix
  • Who is your internet service provider.
Post #4 last edited
Thanks for the reply. I knew my computer was in some serious trouble when this stuff started happening. I cannot format my whole hard drive because my brother has also installed Linux on it and he has some very important files in the Linux partition. Can it be solved by just formatting the C:/ partition and reinstalling? If not, then I would like to go ahead and follow your advice on cleaning my computer.

I cannot restore the hosts file with the tool which you provided. I did it once but when i rebooted the old one was back. I tried again and now i get an error: Cannot create file: C:/Windows/System32/Drivers/ETC/hosts

1) I enabled all startup services in msconfig and did a HJT scan. I didn't get the hosts error this time. Here's the log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:46:22 PM, on 9/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\System32\database.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Eset\nod32kui.exe
C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Config\system.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads.sify.com/RealMedia/ads/click_lx…ridlog=nadeem_d
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\System32\database.exe,
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [winsystem] C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HBService32] System.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [3PMmUpdate] rundll32 "C:\WINDOWS\Update.dll",Main
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Policies\Explorer\Run: [winlogon] C:\Config\system.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C68DBAE-C4EA-4926-96F9-D52AB013DB77}: NameServer = 202.144.115.4,202.144.66.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EE67727-44D2-4689-A9C7-35FD103115B1}: NameServer = 202.144.115.4,202.144.66.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: slbiopfs2.dll - {EB9660D8-E1CD-4ff0-B4A9-00CD907F928A} - (no file)
O21 - SSODL: mstimewd.dll - {65056902-6E7B-4bd7-95BA-688DB5FA5BEB} - (no file)
O21 - SSODL: adsntzt.dll - {E0F3526A-4165-4589-80CD-50B6FBAC3BDA} - (no file)
O21 - SSODL: dispexcb.dll - {76D44356-B494-443a-BEDC-AA68DE4255E6} - (no file)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: DesktopWin - {DA191DE0-AA86-4ED0-4B87-292A3D48BE99} - C:\WINDOWS\AppPatch\DesktopWin.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 7349 bytes

2) Finally i ran Combofix the way you told me but i get a BSOD just seconds after a blue console pops up. The BSOD says:

BAD_POOL_CALLER and the stop error is 0x000000C2 (0x00000040, 0x00000000, 0x80000000, 0x00000000)

3) My ISP is Sify Broadband Limited
Post #5
I rebooted and again now i am getting the hosts error. I thought I would post the HJT log with the error so here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:47:11 PM, on 9/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\System32\database.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Eset\nod32kui.exe
C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Config\system.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads.sify.com/RealMedia/ads/click_lx…ridlog=nadeem_d
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\System32\database.exe,
O1 - Hosts: 127.1 localhost
O1 - Hosts: 127.1 vt0r48p760.cn
O1 - Hosts: 127.1 www.1txx.com
O1 - Hosts: 127.1 www.myovec.cn
O1 - Hosts: 127.1 po.uc-us.cn
O1 - Hosts: 127.1 219.139.83.20
O1 - Hosts: 127.1 www.msj007.cn
O1 - Hosts: 127.1 www.wyf009.cn
O1 - Hosts: 127.1 219.153.71.185
O1 - Hosts: 127.1 59.34.148.68
O1 - Hosts: 127.1 208.43.165.86
O1 - Hosts: 127.1 208.43.166.171
O1 - Hosts: 127.1 219.153.71.185
O1 - Hosts: 127.1 61.164.140.39
O1 - Hosts: 127.1 www.dsabh.cnwww.dsabh.cn
O1 - Hosts: 127.1 cwk1237.3322.org
O1 - Hosts: 127.1 www.woaigan.com
O1 - Hosts: 127.1 munchkin.marketo.net
O1 - Hosts: 127.1 post.marketo.net
O1 - Hosts: 127.1 www.mv2z.cn
O1 - Hosts: 127.1 www.91vva.cn
O1 - Hosts: 127.1 www.wq9q.cn
O1 - Hosts: 127.1 facaizhifuok.cn
O1 - Hosts: 127.1 www.wo9188.cn
O1 - Hosts: 127.1 a.woaigan.com
O1 - Hosts: 127.1 b.woaigan.com
O1 - Hosts: 127.1 xxx.usxx.info
O1 - Hosts: 127.1 alenxya.1122mb.com
O1 - Hosts: 127.1 www.972se.com
O1 - Hosts: 127.1 972se.com
O1 - Hosts: 127.1 pic.03wyt.com
O1 - Hosts: 127.1 d.03wyt.com
O1 - Hosts: 127.1 xs.03wyt.com
O1 - Hosts: 127.1 www.8jse.net
O1 - Hosts: 127.1 8jse.net
O1 - Hosts: 127.1 www.bmwtvb.cn
O1 - Hosts: 127.1 www.kcuf-09.cn
O1 - Hosts: 127.1 www.dvgdfg4650.com
O1 - Hosts: 127.1 www.kcuf-08.cn
O1 - Hosts: 127.1 www.kcuf-11.cn
O1 - Hosts: 127.1 www.kcuf-12.cn
O1 - Hosts: 127.1 1aa1aa.com
O1 - Hosts: 127.1 xx.avno3.com
O1 - Hosts: 127.1 xxx.avno5.com
O1 - Hosts: 127.1 www.avno7.com
O1 - Hosts: 127.1 avno7.com
O1 - Hosts: 127.1 ok.avno4.com
O1 - Hosts: 127.1 ok.avno5.com
O1 - Hosts: 127.1 ok.avno6.com
O1 - Hosts: 127.1 ok.avno7.com
O1 - Hosts: 127.1 ok.avno9.com
O1 - Hosts: 127.1 avno1.com
O1 - Hosts: 127.1 avno3.com
O1 - Hosts: 127.1 avno4.com
O1 - Hosts: 127.1 aikanav.com
O1 - Hosts: 127.1 link.selink.org
O1 - Hosts: 127.1 www.avno6.com
O1 - Hosts: 127.1 avno6.com
O1 - Hosts: 127.1 4.chibbs.info
O1 - Hosts: 127.1 bbs.chibbs.info
O1 - Hosts: 127.1 aa.ss99.biz
O1 - Hosts: 127.1 se.ss99.biz
O1 - Hosts: 127.1 aa.sxlk.net
O1 - Hosts: 127.1 se.sxlk99.com
O1 - Hosts: 127.1 www.88xj.net
O1 - Hosts: 127.1 88xj.net
O1 - Hosts: 127.1 www.99xj.net
O1 - Hosts: 127.1 99xj.net
O1 - Hosts: 127.1 www.91semi.com
O1 - Hosts: 127.1 91semi.com
O1 - Hosts: 127.1 haobaidu.1122mb.com
O1 - Hosts: 127.1 xiao777.za.pl
O1 - Hosts: 127.1 ccavo6.avno6.com
O1 - Hosts: 127.1 a.sxlk99.com
O1 - Hosts: 127.1 www.91vva.cn
O1 - Hosts: 127.1 www.qq08w12.cn
O1 - Hosts: 127.1 www.21xx.info
O1 - Hosts: 127.1 php-1.cn
O1 - Hosts: 127.1 www.v232.com
O1 - Hosts: 127.1 php-2.cn
O1 - Hosts: 127.1 php-3.cn
O1 - Hosts: 127.1 php-4.cn
O1 - Hosts: 127.1 php-5.cn
O1 - Hosts: 127.1 php-6.cn
O1 - Hosts: 127.1 php-7.cn
O1 - Hosts: 127.1 php-8.cn
O1 - Hosts: 127.1 php-9.cn
O1 - Hosts: 127.1 php-10.cn
O1 - Hosts: 127.1 php-11.cn
O1 - Hosts: 127.1 k.5x2x.com
O1 - Hosts: 127.1 a.5x2x.com
O1 - Hosts: 127.1 202.108.23.205
O1 - Hosts: 127.1 60.190.218.21
O1 - Hosts: 127.1 121.14.154.195
O1 - Hosts: 127.1 218.30.82.201
O1 - Hosts: 127.1 59.34.198.48
O1 - Hosts: 127.1 121.14.154.216
O1 - Hosts: 127.1 219.152.120.237
O1 - Hosts: 127.1 121.14.154.184
O1 - Hosts: 127.1 125.67.67.201
O1 - Hosts: 127.1 222.168.102.12
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [winsystem] C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HBService32] System.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [3PMmUpdate] rundll32 "C:\WINDOWS\Update.dll",Main
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Policies\Explorer\Run: [winlogon] C:\Config\system.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C68DBAE-C4EA-4926-96F9-D52AB013DB77}: NameServer = 202.144.115.4,202.144.66.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EE67727-44D2-4689-A9C7-35FD103115B1}: NameServer = 202.144.115.4,202.144.66.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: slbiopfs2.dll - {EB9660D8-E1CD-4ff0-B4A9-00CD907F928A} - (no file)
O21 - SSODL: mstimewd.dll - {65056902-6E7B-4bd7-95BA-688DB5FA5BEB} - (no file)
O21 - SSODL: adsntzt.dll - {E0F3526A-4165-4589-80CD-50B6FBAC3BDA} - (no file)
O21 - SSODL: dispexcb.dll - {76D44356-B494-443a-BEDC-AA68DE4255E6} - (no file)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: DesktopWin - {DA191DE0-AA86-4ED0-4B87-292A3D48BE99} - C:\WINDOWS\AppPatch\DesktopWin.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 10542 bytes
Post #6
Okay I have some good news. I friend of mine had the exact same problem and he used Avast Antivirus to remove it successfully. Well I did the same and the Sam thing was removed. I don't get any pop ups like before. After that I tried ComboFix again and no BSOD this time. I have pasted the Combofix log as well as a new HJT log after that. I think the hosts file problem is also solved. I really really appreciate your help. Can you please take a look at the new HJT log and tell me about any more malware that I might have and how to remove them.

ComboFix 08-09-16.05 - Administrator 2008-09-18 23:00:43.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.95 [GMT 5.5:30]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\AppPatch\AcSpecf.sdb
C:\WINDOWS\AppPatch\AcXtrnel.bpl
C:\WINDOWS\system32\adsntzt.nls
C:\WINDOWS\system32\avicapwm.nls
C:\WINDOWS\system32\cliconfgzx.nls
C:\WINDOWS\system32\dispexcb.nls
C:\WINDOWS\system32\dpvvoxmh.nls
C:\WINDOWS\system32\drivers\cdralw.sys
C:\WINDOWS\system32\kildh3l.cfg
C:\WINDOWS\system32\lweurqhx.nls
C:\WINDOWS\system32\mstimewd.nls
C:\WINDOWS\system32\slbiopfs2.nls
C:\WINDOWS\system32\tscfgwmijxsj.nls
C:\WINDOWS\system32\Update.dat
C:\WINDOWS\system32\xolehlpjh.nls

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_CDRALW
——-\Service_cdralw


((((((((((((((((((((((((( Files Created from 2008-08-18 to 2008-09-18 )))))))))))))))))))))))))))))))
.

2008-09-18 21:37 . 2008-09-18 21:37 d——– C:\Program Files\Alwil Software
2008-09-18 21:37 . 2003-03-19 02:50 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2008-09-18 21:37 . 2003-03-19 01:44 499,712 –a—— C:\WINDOWS\system32\MSVCP71.dll
2008-09-18 13:43 . 2008-09-18 13:43 d–hs—- C:\FOUND.000
2008-09-17 22:43 . 2008-09-17 22:43 d——– C:\Program Files\SpywareGuard
2008-09-17 22:33 . 2005-08-25 18:19 115,920 –a—— C:\WINDOWS\system32\MSINET.OCX
2008-09-17 18:15 . 2008-09-17 18:15 153 –a—— C:\deb.sbl
2008-09-17 16:50 . 2008-09-17 16:50 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6
2008-09-17 16:48 . 2008-09-17 16:49 d——– C:\WINDOWS\Sun
2008-09-17 16:28 . 2008-09-17 16:28 d–hs—- C:\Documents and Settings\Administrator.NAWAF-517FEC36A\PrivacIE
2008-09-17 16:26 . 2003-07-10 01:41 155,648 –a—— C:\WINDOWS\system32\igfxres.dll
2008-09-17 16:25 . 2003-07-10 01:50 94,208 –a—— C:\WINDOWS\system32\igfxcpl.cpl
2008-09-17 15:44 . 2008-09-17 15:44 d–h—– C:\WINDOWS\ie8
2008-09-17 15:05 . 2004-02-01 01:11 13,463,552 –a—— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-09-17 15:04 . 2004-08-04 06:26 2,134,528 –a—— C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-09-17 15:03 . 2004-08-04 13:26 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-09-17 15:02 . 2004-08-04 06:26 32,768 –a—— C:\WINDOWS\system32\dllcache\icwdl.dll
2008-09-17 15:02 . 2004-08-04 06:26 20,480 –a—— C:\WINDOWS\system32\dllcache\inetwiz.exe
2008-09-17 15:02 . 2004-02-01 01:12 16,384 –a—— C:\WINDOWS\system32\dllcache\isignup.exe
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\WindowsShell.Manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\nwc.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 488 -rah—– C:\WINDOWS\system32\logonui.exe.manifest
2008-09-17 15:01 . 2008-09-17 15:01 21,640 –a—— C:\WINDOWS\system32\emptyregdb.dat
2008-09-17 15:01 . 2008-09-17 15:01 37 –a—— C:\WINDOWS\vbaddin.ini
2008-09-17 15:01 . 2008-09-17 15:01 36 –a—— C:\WINDOWS\vb.ini
2008-09-17 14:59 . 2004-02-01 01:11 227,840 –a—— C:\WINDOWS\system32\dllcache\avtapi.dll
2008-09-17 14:59 . 2004-02-01 01:11 227,840 –a—— C:\WINDOWS\system32\avtapi.dll
2008-09-17 14:59 . 2004-02-01 01:11 73,216 –a—— C:\WINDOWS\system32\dllcache\avwav.dll
2008-09-17 14:59 . 2004-02-01 01:11 73,216 –a—— C:\WINDOWS\system32\avwav.dll
2008-09-17 14:59 . 2004-02-01 01:12 44,544 –a—— C:\WINDOWS\system32\hticons.dll
2008-09-17 14:59 . 2004-02-01 01:12 35,328 –a—— C:\WINDOWS\system32\winchat.exe
2008-09-17 14:59 . 2004-02-01 01:12 35,328 –a—— C:\WINDOWS\system32\dllcache\winchat.exe
2008-09-17 14:59 . 2004-02-01 01:11 16,384 –a—— C:\WINDOWS\system32\dllcache\avmeter.dll
2008-09-17 14:59 . 2004-02-01 01:11 16,384 –a—— C:\WINDOWS\system32\avmeter.dll
2008-09-17 14:57 . 2004-02-01 01:12 75,264 –a—— C:\WINDOWS\system32\dllcache\wmipicmp.dll
2008-09-17 14:57 . 2004-02-01 01:12 61,440 –a—— C:\WINDOWS\system32\dllcache\wmimsg.dll
2008-09-17 14:57 . 2004-02-01 01:12 52,224 –a—— C:\WINDOWS\system32\dllcache\wmitimep.dll
2008-09-17 14:55 . 2004-08-04 06:26 1,251,840 –a—— C:\WINDOWS\system32\dllcache\comsvcs.dll
2008-09-17 14:54 . 2004-08-04 06:26 501,248 –a—— C:\WINDOWS\system32\dllcache\clbcatq.dll
2008-09-17 14:54 . 2004-08-04 06:26 501,248 –a—— C:\WINDOWS\system32\clbcatq.dll
2008-09-17 14:54 . 2004-08-04 06:26 144,896 –a—— C:\WINDOWS\system32\dllcache\wmisvc.dll
2008-09-17 14:54 . 2004-08-04 06:26 95,232 –a—— C:\WINDOWS\system32\dllcache\wmiutils.dll
2008-09-17 14:54 . 2004-08-04 06:26 41,472 –a—— C:\WINDOWS\system32\dllcache\wmipsess.dll
2008-09-17 14:52 . 2004-08-04 06:26 196,608 –a—— C:\WINDOWS\system32\dllcache\wbemcntl.dll
2008-09-17 14:51 . 2004-08-04 06:26 131,584 –a—— C:\WINDOWS\system32\dllcache\viewprov.dll
2008-09-17 14:47 . 2004-08-04 07:27 1,086,058 -ra—— C:\WINDOWS\SET51.tmp
2008-09-17 14:47 . 2004-08-04 07:33 1,042,903 -ra—— C:\WINDOWS\SET4E.tmp
2008-09-17 14:47 . 2004-08-04 07:28 13,753 -ra—— C:\WINDOWS\SET5D.tmp
2008-09-17 14:40 . 2008-09-17 14:40 d—s—- C:\WINDOWS\system32\config\systemprofile\History
2008-09-17 14:19 . 2004-08-04 07:27 1,086,058 -ra—— C:\WINDOWS\SET53.tmp
2008-09-17 14:19 . 2004-08-04 07:33 1,042,903 -ra—— C:\WINDOWS\SET50.tmp
2008-09-17 14:19 . 2004-02-01 01:12 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2008-09-17 14:19 . 2004-02-01 01:12 24,661 –a—— C:\WINDOWS\system32\dllcache\spxcoins.dll
2008-09-17 14:19 . 2004-08-04 07:28 13,753 -ra—— C:\WINDOWS\SET5F.tmp
2008-09-17 14:19 . 2004-02-01 01:12 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2008-09-17 14:19 . 2004-02-01 01:12 13,312 –a—— C:\WINDOWS\system32\dllcache\irclass.dll
2008-09-17 12:24 . 2008-09-16 17:42 d——– C:\SDFix
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Program Files\SUPERAntiSpyware
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\SUPERAntiSpyware.com
2008-09-16 23:05 . 2008-09-16 23:05 28,672 –a—— C:\WINDOWS\system32\HBW2I.dll
2008-09-16 15:32 . 2008-09-16 15:32 dr-hs—- C:\Config
2008-09-14 14:51 . 2008-09-14 14:51 d——– C:\K850 Pics
2008-09-14 11:11 . 2008-09-14 11:11 288 –a—— C:\WINDOWS\system32\pntryhml.nls
2008-09-13 23:36 . 2008-09-13 23:36 288 –a—— C:\WINDOWS\system32\fumwxpus.nls
2008-09-13 23:31 . 2008-09-13 23:31 428 –a—— C:\WINDOWS\system32\nwapi32dj.nls
2008-09-12 23:10 . 2008-09-12 23:10 148 –a—— C:\WINDOWS\system32\twainyy.nls
2008-09-12 23:06 . 2008-09-12 23:06 288 –a—— C:\WINDOWS\system32\jbpulqyz.nls
2008-09-12 20:29 . 2008-09-12 20:29 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\JAM Software
2008-09-12 19:54 . 2008-09-12 19:54 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2008-09-12 18:22 . 2008-09-12 18:22 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SecTaskMan
2008-09-12 14:48 . 2008-09-12 14:48 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-09-07 23:53 . 2008-09-07 23:53 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-09-07 23:53 . 2008-09-07 23:53 1,409 –a—— C:\WINDOWS\QTFont.for
2008-09-07 23:24 . 2006-11-10 14:24 90,800 -ra—— C:\WINDOWS\system32\drivers\se2Cunic.sys
2008-09-07 23:24 . 2006-11-10 14:24 88,688 -ra—— C:\WINDOWS\system32\drivers\SE2Cmgmt.sys
2008-09-07 23:24 . 2006-11-10 14:24 86,560 -ra—— C:\WINDOWS\system32\drivers\SE2Cobex.sys
2008-09-07 23:24 . 2006-11-10 14:24 18,704 -ra—— C:\WINDOWS\system32\drivers\se2Cnd5.sys
2008-09-07 23:24 . 2006-11-10 14:24 4,128 -ra—— C:\WINDOWS\system32\drivers\se2Ccr.sys
2008-09-07 23:23 . 2006-11-10 14:24 97,184 -ra—— C:\WINDOWS\system32\drivers\SE2Cmdm.sys
2008-09-07 23:23 . 2006-11-10 14:24 61,600 -ra—— C:\WINDOWS\system32\drivers\SE2Cbus.sys
2008-09-07 23:23 . 2006-11-10 14:24 9,360 -ra—— C:\WINDOWS\system32\drivers\SE2Cmdfl.sys
2008-09-07 23:23 . 2006-11-10 14:24 6,240 -ra—— C:\WINDOWS\system32\drivers\SE2Ccmnt.sys
2008-09-07 23:23 . 2006-11-10 14:24 6,240 -ra—— C:\WINDOWS\system32\drivers\SE2Ccm.sys
2008-09-07 23:23 . 2006-11-10 14:24 5,872 -ra—— C:\WINDOWS\system32\drivers\SE2Cwhnt.sys
2008-09-07 23:23 . 2006-11-10 14:24 5,872 -ra—— C:\WINDOWS\system32\drivers\se2Cwh.sys
2008-09-07 19:34 . 2008-09-07 19:34 d——– C:\WINDOWS\system32\DRVSTORE
2008-09-07 19:25 . 2008-09-07 19:25 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Ericsson
2008-09-07 16:15 . 2007-06-25 15:13 22,952 -ra—— C:\WINDOWS\system32\drivers\s117nd5.sys
2008-09-07 16:14 . 2007-06-25 15:13 100,264 -ra—— C:\WINDOWS\system32\drivers\s117mgmt.sys
2008-09-07 16:14 . 2007-06-25 15:13 98,856 -ra—— C:\WINDOWS\system32\drivers\s117unic.sys
2008-09-07 16:14 . 2007-06-25 15:13 10,792 -ra—— C:\WINDOWS\system32\drivers\s117cr.sys
2008-09-07 16:13 . 2007-06-25 15:13 98,344 -ra—— C:\WINDOWS\system32\drivers\s117obex.sys
2008-09-07 16:12 . 2008-09-07 16:12 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-09-07 16:12 . 2008-09-07 16:12 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\MyPhoneExplorer
2008-09-07 16:10 . 2007-06-25 15:13 108,456 -ra—— C:\WINDOWS\system32\drivers\s117mdm.sys
2008-09-07 16:10 . 2007-06-25 15:13 82,984 -ra—— C:\WINDOWS\system32\drivers\s117bus.sys
2008-09-07 16:10 . 2007-06-25 15:13 14,888 -ra—— C:\WINDOWS\system32\drivers\s117mdfl.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117whnt.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117wh.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117cmnt.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117cm.sys
2008-09-06 15:14 . 2007-01-01 00:00 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-09-06 13:25 . 2008-09-06 13:25 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-09-05 21:47 . 2008-09-05 21:47 17,144 –a—— C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\GDIPFONTCACHEV1.DAT
2008-09-05 21:41 . 2008-09-05 21:41 376 –a—— C:\WINDOWS\ODBC.INI
2008-09-05 21:40 . 2008-09-05 21:40 d–h—– C:\WINDOWS\ShellNew
2008-09-05 18:02 . 2008-09-05 18:02 d–hs—- C:\Documents and Settings\Administrator.NAWAF-517FEC36A\UserData
2008-09-05 16:04 . 2008-09-05 16:04 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Apple Computer
2008-09-04 19:31 . 2008-09-04 19:31 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\dwhelper
2008-09-04 13:23 . 2008-09-04 13:23 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\AdobeUM
2008-09-04 11:19 . 2001-08-17 22:36 138,752 –a—— C:\WINDOWS\system32\sndvol32.exe
2008-09-04 11:19 . 2001-08-17 22:36 138,752 –a—— C:\WINDOWS\system32\dllcache\sndvol32.exe
2008-09-03 16:50 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-09-03 14:07 . 2008-09-03 14:07 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-09-03 14:05 . 2008-09-03 14:05 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Media Player Classic
2008-09-03 14:03 . 2008-09-18 17:36 69 –a—— C:\WINDOWS\NeroDigital.ini
2008-09-03 13:39 . 2008-09-03 13:39 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Ahead
2008-09-03 13:37 . 2008-09-03 13:37 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2008-09-02 21:21 . 2008-09-02 21:22 d——– C:\WINDOWS\system32\LogFiles
2008-09-02 21:20 . 2008-09-02 21:20 d——– C:\WINDOWS\system32\drivers\umdf
2008-09-02 21:19 . 2008-06-12 11:27 26,144 –a—— C:\WINDOWS\system32\spupdsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 21:46 637,984 —-a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-21 21:39 5,699,584 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-21 21:38 878,592 —-a-w C:\WINDOWS\system32\wininet.dll
2008-08-21 21:38 878,592 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
2008-08-21 21:38 43,008 —-a-w C:\WINDOWS\system32\licmgr10.dll
2008-08-21 21:38 43,008 —-a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
2008-08-21 21:38 236,544 —-a-w C:\WINDOWS\system32\dllcache\webcheck.dll
2008-08-21 21:38 1,206,784 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2008-08-21 21:37 755,200 —-a-w C:\WINDOWS\system32\dllcache\VGX.dll
2008-08-21 21:37 193,536 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
2008-08-21 21:37 18,944 —-a-w C:\WINDOWS\system32\dllcache\corpol.dll
2008-08-21 21:37 18,944 —-a-w C:\WINDOWS\system32\corpol.dll
2008-08-21 21:37 116,224 —-a-w C:\WINDOWS\system32\dllcache\occache.dll
2008-08-21 21:37 105,984 —-a-w C:\WINDOWS\system32\dllcache\url.dll
2008-08-21 21:35 70,656 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2008-08-21 21:35 630,272 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2008-08-21 21:35 48,128 —-a-w C:\WINDOWS\system32\mshtmler.dll
2008-08-21 21:35 48,128 —-a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
2008-08-21 21:35 45,056 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-08-21 21:35 35,840 —-a-w C:\WINDOWS\system32\imgutil.dll
2008-08-21 21:35 35,840 —-a-w C:\WINDOWS\system32\dllcache\imgutil.dll
2008-08-21 21:35 346,624 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-08-21 21:35 217,088 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2008-08-21 21:35 186,880 —-a-w C:\WINDOWS\system32\dllcache\iepeers.dll
2008-08-21 21:34 45,568 —-a-w C:\WINDOWS\system32\mshta.exe
2008-08-21 21:34 45,568 —-a-w C:\WINDOWS\system32\dllcache\mshta.exe
2008-08-21 21:30 68,608 —-a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
2008-08-21 21:27 156,160 —-a-w C:\WINDOWS\system32\msls31.dll
2008-08-21 21:27 156,160 —-a-w C:\WINDOWS\system32\dllcache\msls31.dll
2008-08-05 12:25 265,720 —-a-w C:\WINDOWS\system32\msdbg2.dll
2008-07-29 14:05 1,296,896 —-a-w C:\WINDOWS\system32\SPort.dll
2008-07-26 09:05 ——— d—–w C:\Program Files\UPHClean
2006-01-22 22:10 4,825,088 —-a-w C:\Program Files\ymsgrie.exe
2004-11-06 08:52 812 —-a-w C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"SifyBB"="C:\Program Files\Sify Broadband\BBImpSec.exe" [2006-04-21 127085]
"Google Update"="C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-17 133104]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-09-03 155648]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-07-10 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-07-10 114688]

C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 360448]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2006-01-22 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.dvsd"= pdvcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
S0 HBKernel32;HBKernel32 Driver;C:\WINDOWS\system32\DRIVERS\HBKernel32.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c0917d48-7763-11dd-9dcf-00e04d068685}]
\Shell\Auto\command - H:\system.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL system.exe
\Shell\Explore\command - H:\system.exe
\Shell\Open\command - H:\system.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee6b25a8-782d-11dd-9dd0-00e04d068685}]
\Shell\AutoRun\command - F:\winsystem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4GCR-11QF-AAD5-81CP7T635612}]
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\services.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-HBService32 - System.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
HKCU-Explorer_Run-winlogon - C:\Config\system.exe


.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Mozilla\Firefox\Profiles\cgq4yx0n.default\
FF -: plugin - C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.
.
——- File Associations ——-
.
inffile=C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-18 23:04:15
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-09-18 23:08:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-18 17:37:56

Pre-Run: 1,575,895,040 bytes free
Post-Run: 2,466,414,592 bytes free

280

—————————————————————————-
HJT log with everything anabled at startup:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:23, on 2008-09-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads.sify.com/RealMedia/ads/click_lx…ridlog=nadeem_d
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C68DBAE-C4EA-4926-96F9-D52AB013DB77}: NameServer = 202.144.115.4,202.144.66.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EE67727-44D2-4689-A9C7-35FD103115B1}: NameServer = 202.144.115.4,202.144.66.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

–
End of file - 5718 bytes
———————————————————————

After all the scanning I have lost around 500 MB of disk space. How can I recover it?
Post #7
Looks much better.
I did some checking around and as long as your OK with cleaning this machine insted of reformatting will be the easiest way to go.
The best advice I received for formatting was to back up everything important on Linux system and wipe them both out and start over. Because of both windows and Linux on the same drive.

I friend of mine had the exact same problem and he used Avast Antivirus to remove it successfully

I'm curious this wasn't the same friens with the usb sticks was it ?




______________________________
Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.




______________________________
RUN HJT

HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://ads.sify.com/RealMedia/ads/click_lx…ridlog=nadeem_d

Close that.







________________________________________
Open notepad and copy/paste the text in the quotebox below into it: 

Killall::
File:: 
C:\WINDOWS\system32\pntryhml.nls
C:\WINDOWS\system32\fumwxpus.nls
C:\WINDOWS\system32\nwapi32dj.nls
C:\WINDOWS\system32\twainyy.nls
C:\WINDOWS\system32\jbpulqyz.nls
Registry:: 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c0917d48-7763-11dd-9dcf-00e04d068685}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee6b25a8-782d-11dd-9dd0-00e04d068685}]


NOTE: This script was done for this user specifically.
DO NOT ATTEMPT TO USE IT IF YOU ARE NOT THIS USER
YOU WILL HURT THE WORKINGS OF YOUR COMPUTER !!.

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.

______________________________________





Download and install CCleaner from here


If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.

  • Set Cookie Retention.
    Click on the Options block on the left, then choose Cookies.
    Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
  • Reset Temp File Removal for Regular Use.
    Click on the Options block on the left. Select the Advanced button.
    Check "Only delete files in Windows Temp folders older than 48 hours".


    Now run the program and click on Run Cleaner
    ( Do not use the Registry function to clean anything with this program. Having anything auto clean your regisrty is risky).


_________________________________

Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.



_________________________
In your next reply I would like to see:
  • A new HJT log
  • The report from ComboFix
  • The report from Kasperskys
Post #8

I'm curious this wasn't the same friens with the usb sticks was it ?

No way! I am not gonna touch anything the other friend gives me after all this!

Okay everything went on smoothly. Installed Recovery console and all. Here are the logs.

ComboFix Log:

ComboFix 08-09-16.05 - Administrator 2008-09-19 9:10:30.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.118 [GMT 5.5:30]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\fumwxpus.nls
C:\WINDOWS\system32\jbpulqyz.nls
C:\WINDOWS\system32\nwapi32dj.nls
C:\WINDOWS\system32\pntryhml.nls
C:\WINDOWS\system32\twainyy.nls

.
((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))
.

2008-09-18 21:37 . 2008-09-18 21:37 d——– C:\Program Files\Alwil Software
2008-09-18 21:37 . 2003-03-19 02:50 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2008-09-18 21:37 . 2003-03-19 01:44 499,712 –a—— C:\WINDOWS\system32\MSVCP71.dll
2008-09-18 13:43 . 2008-09-18 13:43 d–hs—- C:\FOUND.000
2008-09-17 22:43 . 2008-09-17 22:43 d——– C:\Program Files\SpywareGuard
2008-09-17 22:33 . 2005-08-25 18:19 115,920 –a—— C:\WINDOWS\system32\MSINET.OCX
2008-09-17 18:15 . 2008-09-17 18:15 153 –a—— C:\deb.sbl
2008-09-17 16:50 . 2008-09-17 16:50 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6
2008-09-17 16:48 . 2008-09-17 16:49 d——– C:\WINDOWS\Sun
2008-09-17 16:28 . 2008-09-17 16:28 d–hs—- C:\Documents and Settings\Administrator.NAWAF-517FEC36A\PrivacIE
2008-09-17 16:26 . 2003-07-10 01:41 155,648 –a—— C:\WINDOWS\system32\igfxres.dll
2008-09-17 16:25 . 2003-07-10 01:50 94,208 –a—— C:\WINDOWS\system32\igfxcpl.cpl
2008-09-17 15:44 . 2008-09-17 15:44 d–h—– C:\WINDOWS\ie8
2008-09-17 15:05 . 2004-02-01 01:11 13,463,552 –a—— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-09-17 15:04 . 2004-08-04 06:26 2,134,528 –a—— C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-09-17 15:03 . 2004-08-04 13:26 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-09-17 15:02 . 2004-08-04 06:26 32,768 –a—— C:\WINDOWS\system32\dllcache\icwdl.dll
2008-09-17 15:02 . 2004-08-04 06:26 20,480 –a—— C:\WINDOWS\system32\dllcache\inetwiz.exe
2008-09-17 15:02 . 2004-02-01 01:12 16,384 –a—— C:\WINDOWS\system32\dllcache\isignup.exe
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\WindowsShell.Manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\nwc.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 488 -rah—– C:\WINDOWS\system32\logonui.exe.manifest
2008-09-17 15:01 . 2008-09-17 15:01 21,640 –a—— C:\WINDOWS\system32\emptyregdb.dat
2008-09-17 15:01 . 2008-09-17 15:01 37 –a—— C:\WINDOWS\vbaddin.ini
2008-09-17 15:01 . 2008-09-17 15:01 36 –a—— C:\WINDOWS\vb.ini
2008-09-17 14:59 . 2004-02-01 01:11 227,840 –a—— C:\WINDOWS\system32\dllcache\avtapi.dll
2008-09-17 14:59 . 2004-02-01 01:11 227,840 –a—— C:\WINDOWS\system32\avtapi.dll
2008-09-17 14:59 . 2004-02-01 01:11 73,216 –a—— C:\WINDOWS\system32\dllcache\avwav.dll
2008-09-17 14:59 . 2004-02-01 01:11 73,216 –a—— C:\WINDOWS\system32\avwav.dll
2008-09-17 14:59 . 2004-02-01 01:12 44,544 –a—— C:\WINDOWS\system32\hticons.dll
2008-09-17 14:59 . 2004-02-01 01:12 35,328 –a—— C:\WINDOWS\system32\winchat.exe
2008-09-17 14:59 . 2004-02-01 01:12 35,328 –a—— C:\WINDOWS\system32\dllcache\winchat.exe
2008-09-17 14:59 . 2004-02-01 01:11 16,384 –a—— C:\WINDOWS\system32\dllcache\avmeter.dll
2008-09-17 14:59 . 2004-02-01 01:11 16,384 –a—— C:\WINDOWS\system32\avmeter.dll
2008-09-17 14:57 . 2004-02-01 01:12 75,264 –a—— C:\WINDOWS\system32\dllcache\wmipicmp.dll
2008-09-17 14:57 . 2004-02-01 01:12 61,440 –a—— C:\WINDOWS\system32\dllcache\wmimsg.dll
2008-09-17 14:57 . 2004-02-01 01:12 52,224 –a—— C:\WINDOWS\system32\dllcache\wmitimep.dll
2008-09-17 14:55 . 2004-08-04 06:26 1,251,840 –a—— C:\WINDOWS\system32\dllcache\comsvcs.dll
2008-09-17 14:54 . 2004-08-04 06:26 501,248 –a—— C:\WINDOWS\system32\dllcache\clbcatq.dll
2008-09-17 14:54 . 2004-08-04 06:26 501,248 –a—— C:\WINDOWS\system32\clbcatq.dll
2008-09-17 14:54 . 2004-08-04 06:26 144,896 –a—— C:\WINDOWS\system32\dllcache\wmisvc.dll
2008-09-17 14:54 . 2004-08-04 06:26 95,232 –a—— C:\WINDOWS\system32\dllcache\wmiutils.dll
2008-09-17 14:54 . 2004-08-04 06:26 41,472 –a—— C:\WINDOWS\system32\dllcache\wmipsess.dll
2008-09-17 14:52 . 2004-08-04 06:26 196,608 –a—— C:\WINDOWS\system32\dllcache\wbemcntl.dll
2008-09-17 14:51 . 2004-08-04 06:26 131,584 –a—— C:\WINDOWS\system32\dllcache\viewprov.dll
2008-09-17 14:47 . 2004-08-04 07:27 1,086,058 -ra—— C:\WINDOWS\SET51.tmp
2008-09-17 14:47 . 2004-08-04 07:33 1,042,903 -ra—— C:\WINDOWS\SET4E.tmp
2008-09-17 14:47 . 2004-08-04 07:28 13,753 -ra—— C:\WINDOWS\SET5D.tmp
2008-09-17 14:40 . 2008-09-17 14:40 d—s—- C:\WINDOWS\system32\config\systemprofile\History
2008-09-17 14:19 . 2004-08-04 07:27 1,086,058 -ra—— C:\WINDOWS\SET53.tmp
2008-09-17 14:19 . 2004-08-04 07:33 1,042,903 -ra—— C:\WINDOWS\SET50.tmp
2008-09-17 14:19 . 2004-02-01 01:12 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2008-09-17 14:19 . 2004-02-01 01:12 24,661 –a—— C:\WINDOWS\system32\dllcache\spxcoins.dll
2008-09-17 14:19 . 2004-08-04 07:28 13,753 -ra—— C:\WINDOWS\SET5F.tmp
2008-09-17 14:19 . 2004-02-01 01:12 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2008-09-17 14:19 . 2004-02-01 01:12 13,312 –a—— C:\WINDOWS\system32\dllcache\irclass.dll
2008-09-17 12:24 . 2008-09-16 17:42 d——– C:\SDFix
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Program Files\SUPERAntiSpyware
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\SUPERAntiSpyware.com
2008-09-16 23:05 . 2008-09-16 23:05 28,672 –a—— C:\WINDOWS\system32\HBW2I.dll
2008-09-16 15:32 . 2008-09-16 15:32 dr-hs—- C:\Config
2008-09-14 14:51 . 2008-09-14 14:51 d——– C:\K850 Pics
2008-09-12 20:29 . 2008-09-12 20:29 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\JAM Software
2008-09-12 19:54 . 2008-09-12 19:54 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2008-09-12 18:22 . 2008-09-12 18:22 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SecTaskMan
2008-09-12 14:48 . 2008-09-12 14:48 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-09-07 23:53 . 2008-09-07 23:53 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-09-07 23:53 . 2008-09-07 23:53 1,409 –a—— C:\WINDOWS\QTFont.for
2008-09-07 23:24 . 2006-11-10 14:24 90,800 -ra—— C:\WINDOWS\system32\drivers\se2Cunic.sys
2008-09-07 23:24 . 2006-11-10 14:24 88,688 -ra—— C:\WINDOWS\system32\drivers\SE2Cmgmt.sys
2008-09-07 23:24 . 2006-11-10 14:24 86,560 -ra—— C:\WINDOWS\system32\drivers\SE2Cobex.sys
2008-09-07 23:24 . 2006-11-10 14:24 18,704 -ra—— C:\WINDOWS\system32\drivers\se2Cnd5.sys
2008-09-07 23:24 . 2006-11-10 14:24 4,128 -ra—— C:\WINDOWS\system32\drivers\se2Ccr.sys
2008-09-07 23:23 . 2006-11-10 14:24 97,184 -ra—— C:\WINDOWS\system32\drivers\SE2Cmdm.sys
2008-09-07 23:23 . 2006-11-10 14:24 61,600 -ra—— C:\WINDOWS\system32\drivers\SE2Cbus.sys
2008-09-07 23:23 . 2006-11-10 14:24 9,360 -ra—— C:\WINDOWS\system32\drivers\SE2Cmdfl.sys
2008-09-07 23:23 . 2006-11-10 14:24 6,240 -ra—— C:\WINDOWS\system32\drivers\SE2Ccmnt.sys
2008-09-07 23:23 . 2006-11-10 14:24 6,240 -ra—— C:\WINDOWS\system32\drivers\SE2Ccm.sys
2008-09-07 23:23 . 2006-11-10 14:24 5,872 -ra—— C:\WINDOWS\system32\drivers\SE2Cwhnt.sys
2008-09-07 23:23 . 2006-11-10 14:24 5,872 -ra—— C:\WINDOWS\system32\drivers\se2Cwh.sys
2008-09-07 19:34 . 2008-09-07 19:34 d——– C:\WINDOWS\system32\DRVSTORE
2008-09-07 19:25 . 2008-09-07 19:25 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Ericsson
2008-09-07 16:15 . 2007-06-25 15:13 22,952 -ra—— C:\WINDOWS\system32\drivers\s117nd5.sys
2008-09-07 16:14 . 2007-06-25 15:13 100,264 -ra—— C:\WINDOWS\system32\drivers\s117mgmt.sys
2008-09-07 16:14 . 2007-06-25 15:13 98,856 -ra—— C:\WINDOWS\system32\drivers\s117unic.sys
2008-09-07 16:14 . 2007-06-25 15:13 10,792 -ra—— C:\WINDOWS\system32\drivers\s117cr.sys
2008-09-07 16:13 . 2007-06-25 15:13 98,344 -ra—— C:\WINDOWS\system32\drivers\s117obex.sys
2008-09-07 16:12 . 2008-09-07 16:12 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-09-07 16:12 . 2008-09-07 16:12 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\MyPhoneExplorer
2008-09-07 16:10 . 2007-06-25 15:13 108,456 -ra—— C:\WINDOWS\system32\drivers\s117mdm.sys
2008-09-07 16:10 . 2007-06-25 15:13 82,984 -ra—— C:\WINDOWS\system32\drivers\s117bus.sys
2008-09-07 16:10 . 2007-06-25 15:13 14,888 -ra—— C:\WINDOWS\system32\drivers\s117mdfl.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117whnt.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117wh.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117cmnt.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117cm.sys
2008-09-06 15:14 . 2007-01-01 00:00 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-09-06 13:25 . 2008-09-06 13:25 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-09-05 21:47 . 2008-09-05 21:47 17,144 –a—— C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\GDIPFONTCACHEV1.DAT
2008-09-05 21:41 . 2008-09-05 21:41 376 –a—— C:\WINDOWS\ODBC.INI
2008-09-05 21:40 . 2008-09-05 21:40 d–h—– C:\WINDOWS\ShellNew
2008-09-05 18:02 . 2008-09-05 18:02 d–hs—- C:\Documents and Settings\Administrator.NAWAF-517FEC36A\UserData
2008-09-05 16:04 . 2008-09-05 16:04 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Apple Computer
2008-09-04 19:31 . 2008-09-04 19:31 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\dwhelper
2008-09-04 13:23 . 2008-09-04 13:23 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\AdobeUM
2008-09-04 11:19 . 2001-08-17 22:36 138,752 –a—— C:\WINDOWS\system32\sndvol32.exe
2008-09-04 11:19 . 2001-08-17 22:36 138,752 –a—— C:\WINDOWS\system32\dllcache\sndvol32.exe
2008-09-03 16:50 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-09-03 14:07 . 2008-09-03 14:07 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-09-03 14:05 . 2008-09-03 14:05 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Media Player Classic
2008-09-03 14:03 . 2008-09-18 17:36 69 –a—— C:\WINDOWS\NeroDigital.ini
2008-09-03 13:39 . 2008-09-03 13:39 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Ahead
2008-09-03 13:37 . 2008-09-03 13:37 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2008-09-02 21:21 . 2008-09-02 21:22 d——– C:\WINDOWS\system32\LogFiles
2008-09-02 21:20 . 2008-09-02 21:20 d——– C:\WINDOWS\system32\drivers\umdf
2008-09-02 21:19 . 2008-06-12 11:27 26,144 –a—— C:\WINDOWS\system32\spupdsvc.exe
2008-09-02 21:18 . 2008-09-17 15:10 329,110 –a—— C:\WINDOWS\system32\PerfStringBackup.TMP
2008-09-02 21:16 . 1999-12-17 11:13 86,016 –a—— C:\WINDOWS\unvise32.exe
2008-09-02 21:15 . 2007-06-28 18:52 765,952 –a—— C:\WINDOWS\system32\xvidcore.dll
2008-09-02 21:15 . 2007-06-28 18:54 180,224 –a—— C:\WINDOWS\system32\xvidvfw.dll
2008-09-02 21:15 . 2007-06-28 18:55 77,824 –a—— C:\WINDOWS\system32\xvid.ax

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 21:46 637,984 —-a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-21 21:39 5,699,584 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-21 21:38 878,592 —-a-w C:\WINDOWS\system32\wininet.dll
2008-08-21 21:38 878,592 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
2008-08-21 21:38 43,008 —-a-w C:\WINDOWS\system32\licmgr10.dll
2008-08-21 21:38 43,008 —-a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
2008-08-21 21:38 236,544 —-a-w C:\WINDOWS\system32\dllcache\webcheck.dll
2008-08-21 21:38 1,206,784 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2008-08-21 21:37 755,200 —-a-w C:\WINDOWS\system32\dllcache\VGX.dll
2008-08-21 21:37 193,536 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
2008-08-21 21:37 18,944 —-a-w C:\WINDOWS\system32\dllcache\corpol.dll
2008-08-21 21:37 18,944 —-a-w C:\WINDOWS\system32\corpol.dll
2008-08-21 21:37 116,224 —-a-w C:\WINDOWS\system32\dllcache\occache.dll
2008-08-21 21:37 105,984 —-a-w C:\WINDOWS\system32\dllcache\url.dll
2008-08-21 21:35 70,656 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2008-08-21 21:35 630,272 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2008-08-21 21:35 48,128 —-a-w C:\WINDOWS\system32\mshtmler.dll
2008-08-21 21:35 48,128 —-a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
2008-08-21 21:35 45,056 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-08-21 21:35 35,840 —-a-w C:\WINDOWS\system32\imgutil.dll
2008-08-21 21:35 35,840 —-a-w C:\WINDOWS\system32\dllcache\imgutil.dll
2008-08-21 21:35 346,624 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-08-21 21:35 217,088 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2008-08-21 21:35 186,880 —-a-w C:\WINDOWS\system32\dllcache\iepeers.dll
2008-08-21 21:34 45,568 —-a-w C:\WINDOWS\system32\mshta.exe
2008-08-21 21:34 45,568 —-a-w C:\WINDOWS\system32\dllcache\mshta.exe
2008-08-21 21:30 68,608 —-a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
2008-08-21 21:27 156,160 —-a-w C:\WINDOWS\system32\msls31.dll
2008-08-21 21:27 156,160 —-a-w C:\WINDOWS\system32\dllcache\msls31.dll
2008-08-05 12:25 265,720 —-a-w C:\WINDOWS\system32\msdbg2.dll
2008-07-29 14:05 1,296,896 —-a-w C:\WINDOWS\system32\SPort.dll
2008-07-26 09:05 ——— d—–w C:\Program Files\UPHClean
2006-01-22 22:10 4,825,088 —-a-w C:\Program Files\ymsgrie.exe
2004-11-06 08:52 812 —-a-w C:\Program Files\INSTALL.LOG
2001-11-23 04:08 712,704 —ha-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-09-18_23.07.26.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-04-15 09:01:50 107,776 —-a-w C:\WINDOWS\setupupd\dudrvs\3229025\ac97ich4.sys
+ 2001-07-14 12:02:24 69,632 —-a-w C:\WINDOWS\setupupd\temp\wsdueng.dll
+ 2008-09-19 03:43:40 16,384 —-a-w C:\WINDOWS\Temp\Perflib_Perfdata_4c4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"SifyBB"="C:\Program Files\Sify Broadband\BBImpSec.exe" [2006-04-21 127085]
"Google Update"="C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-17 133104]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-09-03 155648]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-07-10 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-07-10 114688]

C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 360448]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2006-01-22 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.dvsd"= pdvcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
S0 HBKernel32;HBKernel32 Driver;C:\WINDOWS\system32\DRIVERS\HBKernel32.sys [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4GCR-11QF-AAD5-81CP7T635612}]
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\services.exe
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-19 09:13:54
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-09-19 9:16:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-19 03:46:24
ComboFix2.txt 2008-09-18 17:38:06

Pre-Run: 2,455,371,776 bytes free
Post-Run: 2,444,410,880 bytes free

250
____________________________________________________________________


Kaspersky Scan Report:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, September 19, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, September 19, 2008 04:42:21
Records in database: 1248747
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 47335
Threat name: 42
Infected objects: 58
Suspicious objects: 0
Duration of the scan: 02:06:39


File name / Threat name / Threats count
C:\Documents and Settings\Nawaf\Desktop\Extra stuff\Cisco\free utilities\boson_utilities.exe Infected: not-a-virus:PSWTool.Win32.GetPass.e 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\johandy.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.teba 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\familykeylogger.zip.bac_a00992 Infected: not-a-virus:Monitor.Win32.FamilyKeyLogger.280 3
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\autorun.inf.bac_a00992 Infected: Backdoor.Win32.Hupigon.cfeh 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\tmp29.tmp.bac_a00992 Infected: Trojan-PSW.Win32.OnLineGames.arni 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\tmp36.tmp.bac_a00992 Infected: Trojan-PSW.Win32.OnLineGames.arni 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\tmpE5.tmp.bac_a00992 Infected: Trojan-PSW.Win32.OnLineGames.arni 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\23[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tclu 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\catower.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.thgx 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\mcromv.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tcvv 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\thermaltinc.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdsi 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\system.exe.bac_a00992 Infected: Backdoor.Win32.Agent.rnq 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\20[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdyl 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\9[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tghu 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\19[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tgvh 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\7[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.thdu 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\11[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tfto 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\14[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tguz 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\21[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tgih 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\5[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdso 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\fumwxpus.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tfyp 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\mshta.dll.bac_a00992 Infected: Trojan-Proxy.Win32.Agent.axl 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\lensch.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tedd 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\b[1].gif.bac_a00992 Infected: Trojan-Downloader.Win32.Agent.wxq 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\28[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.szcu 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\mduaey.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tbwk 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\13[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdxz 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\BePipe.exe.bac_a00992 Infected: Virus.Win32.Alman.b 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\A0000111.exe.bac_a00992 Infected: Virus.Win32.Alman.b 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\AclLayer.dll.bac_a00992 Infected: Trojan-Downloader.Win32.Small.yhf 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\eskisl.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tcbb 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\18[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tgvd 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\22[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tbme 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\1b[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdyf 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\31[1].gif.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdyf 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\linkinfo.dll.bac_a00992 Infected: Virus.Win32.Agent.bu 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\qxfel.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.swbm 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\1a[1].gif.bac_a00992 Infected: Trojan-Proxy.Win32.Agent.awt 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\a[1].gif.bac_a00992 Infected: Trojan-Proxy.Win32.Agent.awt 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\update[2].gif.bac_a00992 Infected: Trojan-Downloader.Win32.Small.xwr 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\update[1].gif.bac_a00992 Infected: Trojan-Downloader.Win32.Small.xwr 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\cdralw.sys.bac_a00992 Infected: Virus.Win32.Alman.b 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\d[1].gif.bac_a00992 Infected: Virus.Win32.Alman.a 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\tmp27.tmp.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdwr 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\tmp34.tmp.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdwr 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\tmpE3.tmp.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdwr 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\wrm32.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tdwr 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\aotoppt.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tgno 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\jolndyo.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.thck 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\HBKernel32.sys.bac_a00992 Infected: Backdoor.Win32.Agent.rnq 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\pewire.dll.bac_a00992 Infected: Trojan-GameThief.Win32.OnLineGames.tgwe 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\wmsetup.dll.bac_a00992 Infected: Trojan-Downloader.Win32.Murlo.nn 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\abb[1].gif.bac_a00992 Infected: Trojan-Downloader.Win32.Murlo.nn 1
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine\HBSOUL.dll.bac_a00992 Infected: Backdoor.Win32.Agent.rog 1
C:\Config\autorun.inf Infected: Backdoor.Win32.Hupigon.cfeh 1
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\cdralw.sys.vir Infected: Virus.Win32.Alman.b 1

The selected area was scanned.
_____________________________________________________________


A new HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:01, on 2008-09-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C68DBAE-C4EA-4926-96F9-D52AB013DB77}: NameServer = 202.144.115.4,202.144.66.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EE67727-44D2-4689-A9C7-35FD103115B1}: NameServer = 202.144.115.4,202.144.66.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

–
End of file - 5487 bytes
_______________________________________________________________

That's it. I hope there's some improvement.
Post #9
Delete the contents of this folder. Not the folder itself.

Navigate to :

C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6\Quarantine
Once in that folder

click edit /select all/ then hit the delete key





________________________________________
Open notepad and copy/paste the text in the quotebox below into it: 

File:: 
C:\Documents and Settings\Nawaf\Desktop\Extra stuff\Cisco\free utilities\boson_utilities.exe 
C:\Config\autorun.inf 
Driver:: 
HBKernel32


NOTE: This script was done for this user specifically.
DO NOT ATTEMPT TO USE IT IF YOU ARE NOT THIS USER
YOU WILL HURT THE WORKINGS OF YOUR COMPUTER !!.

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.

___________________________________________


I see no evidence of a fire wall. I suggest you get one in place now.

A few words on Microsofts firewall in XP . It only works in one direction. Incoming.
That means if something gets by it you would never know it was trying
to contact the internet.
Example: A bad program installs itself. You would never know it was contacting the internet.
Downloading other nasties and so forth.

If you decide to run one of these you should be certain Microsofts firewall is disabled.
To disable it.

I will list a few free firewalls for you. These are good (free) firewalls:

Never run 2 firwalls together. They will interfere with each other.
So just download and install one!


Firewalls
Comodo If choosing this one be sure to UNCHECK install ask tool bar during installation,

Sunbelt Personal Firewall

Online armor Firewall


________________________

That's it. I hope there's some improvement.

Me too! :popcorn:

_________________________
In your next reply I would like to see:
  • A new HJT log
  • The report from ComboFix
  • How do things seem to be running ?
  • OH! Don't forget to tell your friend he's more than likely infected. :wavey:
Post #10
Ok everything went on smoothly, except for Comodor which kept popping up when ComboFix was running. I disabled it temporarily then it wouldn't start on the next startup. Gave some error. After some fooling around i managed to reinstall it though. There are still some things in it which I don't understand. At any random time it pops up a message that something is trying to connect to the internet. I don't know what to allow and what to block. At some point my internet wouldn't work. I disabled the Firewall and it worked. Right now however it's working pretty well. No popups and my internet is working fine.

Now the logs:

ComboFix Log

ComboFix 08-09-16.05 - Administrator 2008-09-19 20:06:52.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.72 [GMT 5.5:30]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Config\autorun.inf
C:\Documents and Settings\Nawaf\Desktop\Extra stuff\Cisco\free utilities\boson_utilities.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_HBKERNEL32
——-\Service_HBKernel32


((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))
.

2008-09-19 19:55 . 2008-09-19 19:55 d——– C:\Program Files\COMODO
2008-09-19 19:55 . 2008-09-19 19:55 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\comodo
2008-09-19 19:55 . 2008-09-19 19:55 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Comodo
2008-09-19 19:55 . 2008-09-19 19:55 143,104 –a—— C:\WINDOWS\system32\guard32.dll
2008-09-19 19:55 . 2008-09-19 19:55 87,056 –a—— C:\WINDOWS\system32\drivers\cmdguard.sys
2008-09-19 19:55 . 2008-09-19 19:55 24,208 –a—— C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-09-18 21:37 . 2008-09-18 21:37 d——– C:\Program Files\Alwil Software
2008-09-18 21:37 . 2003-03-19 02:50 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2008-09-18 21:37 . 2003-03-19 01:44 499,712 –a—— C:\WINDOWS\system32\MSVCP71.dll
2008-09-18 13:43 . 2008-09-18 13:43 d–hs—- C:\FOUND.000
2008-09-17 22:43 . 2008-09-17 22:43 d——– C:\Program Files\SpywareGuard
2008-09-17 22:33 . 2005-08-25 18:19 115,920 –a—— C:\WINDOWS\system32\MSINET.OCX
2008-09-17 18:15 . 2008-09-17 18:15 153 –a—— C:\deb.sbl
2008-09-17 16:50 . 2008-09-17 16:50 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\.housecall6.6
2008-09-17 16:48 . 2008-09-17 16:49 d——– C:\WINDOWS\Sun
2008-09-17 16:28 . 2008-09-17 16:28 d–hs—- C:\Documents and Settings\Administrator.NAWAF-517FEC36A\PrivacIE
2008-09-17 16:26 . 2003-07-10 01:41 155,648 –a—— C:\WINDOWS\system32\igfxres.dll
2008-09-17 16:25 . 2003-07-10 01:50 94,208 –a—— C:\WINDOWS\system32\igfxcpl.cpl
2008-09-17 15:44 . 2008-09-17 15:44 d–h—– C:\WINDOWS\ie8
2008-09-17 15:05 . 2004-02-01 01:11 13,463,552 –a—— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-09-17 15:04 . 2004-08-04 06:26 2,134,528 –a—— C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-09-17 15:03 . 2004-08-04 13:26 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-09-17 15:02 . 2004-08-04 06:26 32,768 –a—— C:\WINDOWS\system32\dllcache\icwdl.dll
2008-09-17 15:02 . 2004-08-04 06:26 20,480 –a—— C:\WINDOWS\system32\dllcache\inetwiz.exe
2008-09-17 15:02 . 2004-02-01 01:12 16,384 –a—— C:\WINDOWS\system32\dllcache\isignup.exe
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\WindowsShell.Manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\sapi.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\nwc.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 749 -rah—– C:\WINDOWS\system32\ncpa.cpl.manifest
2008-09-17 15:02 . 2008-09-17 15:02 488 -rah—– C:\WINDOWS\system32\logonui.exe.manifest
2008-09-17 15:01 . 2008-09-17 15:01 21,640 –a—— C:\WINDOWS\system32\emptyregdb.dat
2008-09-17 15:01 . 2008-09-17 15:01 37 –a—— C:\WINDOWS\vbaddin.ini
2008-09-17 15:01 . 2008-09-17 15:01 36 –a—— C:\WINDOWS\vb.ini
2008-09-17 14:59 . 2004-02-01 01:11 227,840 –a—— C:\WINDOWS\system32\dllcache\avtapi.dll
2008-09-17 14:59 . 2004-02-01 01:11 227,840 –a—— C:\WINDOWS\system32\avtapi.dll
2008-09-17 14:59 . 2004-02-01 01:11 73,216 –a—— C:\WINDOWS\system32\dllcache\avwav.dll
2008-09-17 14:59 . 2004-02-01 01:11 73,216 –a—— C:\WINDOWS\system32\avwav.dll
2008-09-17 14:59 . 2004-02-01 01:12 44,544 –a—— C:\WINDOWS\system32\hticons.dll
2008-09-17 14:59 . 2004-02-01 01:12 35,328 –a—— C:\WINDOWS\system32\winchat.exe
2008-09-17 14:59 . 2004-02-01 01:12 35,328 –a—— C:\WINDOWS\system32\dllcache\winchat.exe
2008-09-17 14:59 . 2004-02-01 01:11 16,384 –a—— C:\WINDOWS\system32\dllcache\avmeter.dll
2008-09-17 14:59 . 2004-02-01 01:11 16,384 –a—— C:\WINDOWS\system32\avmeter.dll
2008-09-17 14:57 . 2004-02-01 01:12 75,264 –a—— C:\WINDOWS\system32\dllcache\wmipicmp.dll
2008-09-17 14:57 . 2004-02-01 01:12 61,440 –a—— C:\WINDOWS\system32\dllcache\wmimsg.dll
2008-09-17 14:57 . 2004-02-01 01:12 52,224 –a—— C:\WINDOWS\system32\dllcache\wmitimep.dll
2008-09-17 14:55 . 2004-08-04 06:26 1,251,840 –a—— C:\WINDOWS\system32\dllcache\comsvcs.dll
2008-09-17 14:54 . 2004-08-04 06:26 501,248 –a—— C:\WINDOWS\system32\dllcache\clbcatq.dll
2008-09-17 14:54 . 2004-08-04 06:26 501,248 –a—— C:\WINDOWS\system32\clbcatq.dll
2008-09-17 14:54 . 2004-08-04 06:26 144,896 –a—— C:\WINDOWS\system32\dllcache\wmisvc.dll
2008-09-17 14:54 . 2004-08-04 06:26 95,232 –a—— C:\WINDOWS\system32\dllcache\wmiutils.dll
2008-09-17 14:54 . 2004-08-04 06:26 41,472 –a—— C:\WINDOWS\system32\dllcache\wmipsess.dll
2008-09-17 14:52 . 2004-08-04 06:26 196,608 –a—— C:\WINDOWS\system32\dllcache\wbemcntl.dll
2008-09-17 14:51 . 2004-08-04 06:26 131,584 –a—— C:\WINDOWS\system32\dllcache\viewprov.dll
2008-09-17 14:47 . 2004-08-04 07:27 1,086,058 -ra—— C:\WINDOWS\SET51.tmp
2008-09-17 14:47 . 2004-08-04 07:33 1,042,903 -ra—— C:\WINDOWS\SET4E.tmp
2008-09-17 14:47 . 2004-08-04 07:28 13,753 -ra—— C:\WINDOWS\SET5D.tmp
2008-09-17 14:40 . 2008-09-17 14:40 d—s—- C:\WINDOWS\system32\config\systemprofile\History
2008-09-17 14:19 . 2004-08-04 07:27 1,086,058 -ra—— C:\WINDOWS\SET53.tmp
2008-09-17 14:19 . 2004-08-04 07:33 1,042,903 -ra—— C:\WINDOWS\SET50.tmp
2008-09-17 14:19 . 2004-02-01 01:12 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2008-09-17 14:19 . 2004-02-01 01:12 24,661 –a—— C:\WINDOWS\system32\dllcache\spxcoins.dll
2008-09-17 14:19 . 2004-08-04 07:28 13,753 -ra—— C:\WINDOWS\SET5F.tmp
2008-09-17 14:19 . 2004-02-01 01:12 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2008-09-17 14:19 . 2004-02-01 01:12 13,312 –a—— C:\WINDOWS\system32\dllcache\irclass.dll
2008-09-17 12:24 . 2008-09-16 17:42 d——– C:\SDFix
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Program Files\SUPERAntiSpyware
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-09-17 11:40 . 2008-09-17 11:40 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\SUPERAntiSpyware.com
2008-09-16 23:05 . 2008-09-16 23:05 28,672 –a—— C:\WINDOWS\system32\HBW2I.dll
2008-09-16 15:32 . 2008-09-16 15:32 dr-hs—- C:\Config
2008-09-14 14:51 . 2008-09-14 14:51 d——– C:\K850 Pics
2008-09-12 20:29 . 2008-09-12 20:29 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\JAM Software
2008-09-12 19:54 . 2008-09-12 19:54 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2008-09-12 18:22 . 2008-09-12 18:22 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\SecTaskMan
2008-09-12 14:48 . 2008-09-12 14:48 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-09-07 23:53 . 2008-09-07 23:53 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-09-07 23:53 . 2008-09-07 23:53 1,409 –a—— C:\WINDOWS\QTFont.for
2008-09-07 23:24 . 2006-11-10 14:24 90,800 -ra—— C:\WINDOWS\system32\drivers\se2Cunic.sys
2008-09-07 23:24 . 2006-11-10 14:24 88,688 -ra—— C:\WINDOWS\system32\drivers\SE2Cmgmt.sys
2008-09-07 23:24 . 2006-11-10 14:24 86,560 -ra—— C:\WINDOWS\system32\drivers\SE2Cobex.sys
2008-09-07 23:24 . 2006-11-10 14:24 18,704 -ra—— C:\WINDOWS\system32\drivers\se2Cnd5.sys
2008-09-07 23:24 . 2006-11-10 14:24 4,128 -ra—— C:\WINDOWS\system32\drivers\se2Ccr.sys
2008-09-07 23:23 . 2006-11-10 14:24 97,184 -ra—— C:\WINDOWS\system32\drivers\SE2Cmdm.sys
2008-09-07 23:23 . 2006-11-10 14:24 61,600 -ra—— C:\WINDOWS\system32\drivers\SE2Cbus.sys
2008-09-07 23:23 . 2006-11-10 14:24 9,360 -ra—— C:\WINDOWS\system32\drivers\SE2Cmdfl.sys
2008-09-07 23:23 . 2006-11-10 14:24 6,240 -ra—— C:\WINDOWS\system32\drivers\SE2Ccmnt.sys
2008-09-07 23:23 . 2006-11-10 14:24 6,240 -ra—— C:\WINDOWS\system32\drivers\SE2Ccm.sys
2008-09-07 23:23 . 2006-11-10 14:24 5,872 -ra—— C:\WINDOWS\system32\drivers\SE2Cwhnt.sys
2008-09-07 23:23 . 2006-11-10 14:24 5,872 -ra—— C:\WINDOWS\system32\drivers\se2Cwh.sys
2008-09-07 19:34 . 2008-09-07 19:34 d——– C:\WINDOWS\system32\DRVSTORE
2008-09-07 19:25 . 2008-09-07 19:25 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Ericsson
2008-09-07 16:15 . 2007-06-25 15:13 22,952 -ra—— C:\WINDOWS\system32\drivers\s117nd5.sys
2008-09-07 16:14 . 2007-06-25 15:13 100,264 -ra—— C:\WINDOWS\system32\drivers\s117mgmt.sys
2008-09-07 16:14 . 2007-06-25 15:13 98,856 -ra—— C:\WINDOWS\system32\drivers\s117unic.sys
2008-09-07 16:14 . 2007-06-25 15:13 10,792 -ra—— C:\WINDOWS\system32\drivers\s117cr.sys
2008-09-07 16:13 . 2007-06-25 15:13 98,344 -ra—— C:\WINDOWS\system32\drivers\s117obex.sys
2008-09-07 16:12 . 2008-09-07 16:12 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-09-07 16:12 . 2008-09-07 16:12 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\MyPhoneExplorer
2008-09-07 16:10 . 2007-06-25 15:13 108,456 -ra—— C:\WINDOWS\system32\drivers\s117mdm.sys
2008-09-07 16:10 . 2007-06-25 15:13 82,984 -ra—— C:\WINDOWS\system32\drivers\s117bus.sys
2008-09-07 16:10 . 2007-06-25 15:13 14,888 -ra—— C:\WINDOWS\system32\drivers\s117mdfl.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117whnt.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117wh.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117cmnt.sys
2008-09-07 16:10 . 2007-06-25 15:13 12,200 -ra—— C:\WINDOWS\system32\drivers\s117cm.sys
2008-09-06 15:14 . 2007-01-01 00:00 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-09-06 13:25 . 2008-09-06 13:25 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-09-05 21:47 . 2008-09-05 21:47 17,144 –a—— C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\GDIPFONTCACHEV1.DAT
2008-09-05 21:41 . 2008-09-05 21:41 376 –a—— C:\WINDOWS\ODBC.INI
2008-09-05 21:40 . 2008-09-05 21:40 d–h—– C:\WINDOWS\ShellNew
2008-09-05 18:02 . 2008-09-05 18:02 d–hs—- C:\Documents and Settings\Administrator.NAWAF-517FEC36A\UserData
2008-09-05 16:04 . 2008-09-05 16:04 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Apple Computer
2008-09-04 19:31 . 2008-09-04 19:31 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\dwhelper
2008-09-04 13:23 . 2008-09-04 13:23 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\AdobeUM
2008-09-04 11:19 . 2001-08-17 22:36 138,752 –a—— C:\WINDOWS\system32\sndvol32.exe
2008-09-04 11:19 . 2001-08-17 22:36 138,752 –a—— C:\WINDOWS\system32\dllcache\sndvol32.exe
2008-09-03 16:50 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-09-03 14:07 . 2008-09-03 14:07 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-09-03 14:05 . 2008-09-03 14:05 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Media Player Classic
2008-09-03 14:03 . 2008-09-18 17:36 69 –a—— C:\WINDOWS\NeroDigital.ini
2008-09-03 13:39 . 2008-09-03 13:39 d——– C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Application Data\Ahead
2008-09-03 13:37 . 2008-09-03 13:37 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2008-09-02 21:21 . 2008-09-02 21:22 d——– C:\WINDOWS\system32\LogFiles
2008-09-02 21:20 . 2008-09-02 21:20 d——– C:\WINDOWS\system32\drivers\umdf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 21:46 637,984 —-a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-21 21:39 5,699,584 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-21 21:38 878,592 —-a-w C:\WINDOWS\system32\wininet.dll
2008-08-21 21:38 878,592 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
2008-08-21 21:38 43,008 —-a-w C:\WINDOWS\system32\licmgr10.dll
2008-08-21 21:38 43,008 —-a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
2008-08-21 21:38 236,544 —-a-w C:\WINDOWS\system32\dllcache\webcheck.dll
2008-08-21 21:38 1,206,784 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2008-08-21 21:37 755,200 —-a-w C:\WINDOWS\system32\dllcache\VGX.dll
2008-08-21 21:37 193,536 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
2008-08-21 21:37 18,944 —-a-w C:\WINDOWS\system32\dllcache\corpol.dll
2008-08-21 21:37 18,944 —-a-w C:\WINDOWS\system32\corpol.dll
2008-08-21 21:37 116,224 —-a-w C:\WINDOWS\system32\dllcache\occache.dll
2008-08-21 21:37 105,984 —-a-w C:\WINDOWS\system32\dllcache\url.dll
2008-08-21 21:35 70,656 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2008-08-21 21:35 630,272 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2008-08-21 21:35 48,128 —-a-w C:\WINDOWS\system32\mshtmler.dll
2008-08-21 21:35 48,128 —-a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
2008-08-21 21:35 45,056 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-08-21 21:35 35,840 —-a-w C:\WINDOWS\system32\imgutil.dll
2008-08-21 21:35 35,840 —-a-w C:\WINDOWS\system32\dllcache\imgutil.dll
2008-08-21 21:35 346,624 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-08-21 21:35 217,088 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2008-08-21 21:35 186,880 —-a-w C:\WINDOWS\system32\dllcache\iepeers.dll
2008-08-21 21:34 45,568 —-a-w C:\WINDOWS\system32\mshta.exe
2008-08-21 21:34 45,568 —-a-w C:\WINDOWS\system32\dllcache\mshta.exe
2008-08-21 21:30 68,608 —-a-w C:\WINDOWS\system32\dllcache\hmmapi.dll
2008-08-21 21:27 156,160 —-a-w C:\WINDOWS\system32\msls31.dll
2008-08-21 21:27 156,160 —-a-w C:\WINDOWS\system32\dllcache\msls31.dll
2008-08-05 12:25 265,720 —-a-w C:\WINDOWS\system32\msdbg2.dll
2008-07-29 14:05 1,296,896 —-a-w C:\WINDOWS\system32\SPort.dll
2008-07-26 09:05 ——— d—–w C:\Program Files\UPHClean
2006-01-22 22:10 4,825,088 —-a-w C:\Program Files\ymsgrie.exe
2004-11-06 08:52 812 —-a-w C:\Program Files\INSTALL.LOG
2001-11-23 04:08 712,704 —ha-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-09-18_23.07.26.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-04-15 09:01:50 107,776 —-a-w C:\WINDOWS\setupupd\dudrvs\3229025\ac97ich4.sys
+ 2001-07-14 12:02:24 69,632 —-a-w C:\WINDOWS\setupupd\temp\wsdueng.dll
+ 2008-09-19 14:25:26 79,760 —-a-w C:\WINDOWS\system32\drivers\inspect.sys
+ 2008-09-19 14:41:20 16,384 —-a-w C:\WINDOWS\Temp\Perflib_Perfdata_4ec.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"SifyBB"="C:\Program Files\Sify Broadband\BBImpSec.exe" [2006-04-21 127085]
"Google Update"="C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-17 133104]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-09-03 155648]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-07-10 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-07-10 114688]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-09-19 1655552]

C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 360448]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2006-01-22 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.dvsd"= pdvcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-09-19 87056]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-09-19 24208]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4GCR-11QF-AAD5-81CP7T635612}]
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\services.exe
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-19 20:11:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-09-19 20:15:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-19 14:44:58
ComboFix3.txt 2008-09-18 17:38:06
ComboFix2.txt 2008-09-19 03:46:32

Pre-Run: 2,307,276,800 bytes free
Post-Run: 2,349,350,912 bytes free

258
______________________________________________________________________

Newest HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:48, on 2008-09-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\ping.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C68DBAE-C4EA-4926-96F9-D52AB013DB77}: NameServer = 202.144.115.4,202.144.66.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EE67727-44D2-4689-A9C7-35FD103115B1}: NameServer = 202.144.115.4,202.144.66.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

–
End of file - 5906 bytes
__________________________________________________________________

How do things seem to be running ?

Actually my computer was never slow even when it had so much malware. That's the reason I didn't suspect anything. Everything was running smoothly. Startup/Shutdown was pretty fast. Even when Mr Sam was aboard I didn't feel the computer was slowing down. Only after reading your reply did I find out that my machine was highly infected. Right now everything is working fine.

I have already asked my friend to post his log here. You guys are doing a great job. Keep up the good work!

Still waiting for your 'All Clean' verdict…….
Post #11
Glad you got the Firewall installed. Probably should have waited until combofix was run and done. Would have saved you some grief.
Things look good to just a few orphaned entries to fix with HJT now that you uninstalled AVG . I will NOT need to see a new HJT log.


______________________________
RUN HJT

HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

Close that.


__________________________________
The firewall.
There should be a box to place a check mark in each time it pops up asking if you want to allow such and such a program to contact the internet. (remember this answer)
Be sure of the program before you tick that check mark. If your unsure google it. You'de be surprised how easy it is to find answers. And by doing this you will learn alot your computer.

Naturally allow things like your browser and programs you purposley install. It's usually the out of the blue when your firewall asks you something should you be concerned.

At first this can become annoying but as time goes on you will teach your firewall what to allow. And some day when and if
another nasty wants to contact the internet and you stop it before it does any harm you'll see the benifits.


Heres two that you can allow.

svchost.exe
generic host process


Heres a link to comodos forum if you need further help.
http://forums.comodo.com/comodo_firewall-b50.0/

_____________________________________________



Great news ! [external image: Posted Image]

Your logs now appears to be clean.

Lets do a few things to tidy up.




________________________________
Go to start > run and copy and paste this in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the
system/hidden files and resets System Restore again.

______________________________





A few things to help with possible threats

These are optional . But will help protect you further.
___________________________________

SpywareBlaster

Install SpywareBlaster

SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs.
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.







___________________________________
Download and Install a HOSTS File
A Hosts file is a plain text file which prevents your computer from connecting to malware and spyware sites by redirecting the connection request to 127.0.0.1, which is your local address. If you use a proxy server, or if you are on AOL, be sure to read the special instructions.
You can download the MVPS Hosts File and see a HOSTS file tutorial here :
This website also contains useful tips, and links to other resources and utilities.







___________________________________
Make your Internet Explorer more secure
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click on the Security tab
3. Click the Internet icon so it becomes highlighted.
4. Click on Default Level and click Ok
5. Click on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

6. Next press the Apply button and then the OK to exit the Internet Properties page.


Here's a site with great advise on how to AVOID malware. Much easier to do than removing it.






Safe and Happy Surfing. :)
Post #12
Okay did everything you told. Great to hear that my computer is clean finally. And yeah I have Spyware Blaster, Spyware Guard and Avast AntiVirus installed. Is it okay to have all three installed at the same time? I never use Internet Explorer. Always Firefox. So if there's anything I can do to make Firefox also more secure I will do that. And again thanks for the help and time that you have given to my problem. Really appreciate it. Keep up the great work!
Post #13

And yeah I have Spyware Blaster, Spyware Guard and Avast AntiVirus installed. Is it okay to have all three installed at the same time?

Yes.

Firefox will be a bit safer by default . Placing the host file in place will be added protection.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI