Spyware / Malware / Virus Removal

[Resolved] Internet Server Sometimes Broken

15 min read

Looking for the outcome? Ask AI

goku2000u Topic Starter

Post #1November 14, 2008, 8:11 PM UTC

Hello,

I am using a Windows XP - eMachines Model T-5048.

I have been deleting a bunch of Trojans, and my computer seems to be running normal now, as if it was new. Now, sometimes, when I go to google or any other site, it keeps giving me a page error, saying that the Server is busy or error, stuff like that. When I go to Youtube, I comment on pages and it gives me this error "Oops! Unable to contact server!" Now SOMETIMES after this message, my internet does not work, I always keep restarting my computer to get it fixed, but still does it. Here is my hijackthis log. Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:06:53 PM, on 11/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Cristian\Application Data\U3\000016244373AFF4\LaunchPad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://windiwsfsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windiwsfsearch.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windiwsfsearch.com/ie6.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://windiwsfsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\Cristian\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O20 - AppInit_DLLs: ycshtb.dll wexyyv.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

–
End of file - 5702 bytes

Rorschach112

Post #2November 14, 2008, 8:24 PM UTC

Hello

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

goku2000u

Post #3November 14, 2008, 11:38 PM UTC

This is the log.

——————–\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.06GHz )
BIOS : Default System BIOS
USER : Cristian ( Administrator )
BOOT : Normal boot
Antivirus : McAfee VirusScan (Activated)
C:\ (Local Disk) - NTFS - Total:149 Go (Free:131 Go)
D:\ (CD or DVD)
E:\ (USB) - FAT32 - Total:1818 Mo (Free:0 Go)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Fri 11/14/2008|18:31 )

——————–\\ Listing folders in APPLIC~1

[06/17/2006|04:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Identities
[06/19/2006|01:18] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft

[09/02/2008|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
[10/20/2008|09:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[08/28/2008|07:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ acccore
[09/30/2008|08:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[07/02/2008|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ahead
[06/03/2008|12:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[07/31/2008|04:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL Downloads
[06/03/2008|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL OCP
[05/01/2008|04:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[10/20/2008|09:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[04/25/2008|04:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CanonBJ
[11/08/2008|12:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CopyTransControlCenter
[09/09/2008|04:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ FLEXnet
[04/28/2008|03:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[08/21/2008|04:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Haihaisoft
[10/04/2008|10:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[09/06/2008|04:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee
[09/06/2008|11:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee.com
[10/10/2008|02:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[07/03/2008|11:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Napster
[09/30/2008|08:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NOS
[10/04/2008|08:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ovefwfif
[08/04/2008|02:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PC Drivers HeadQuarters
[06/19/2006|01:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Prism Deploy
[10/27/2008|03:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Screaming Bee
[09/06/2008|11:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SiteAdvisor
[10/31/2008|10:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[10/17/2008|02:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SUPERAntiSpyware.com
[10/04/2008|11:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[10/04/2008|08:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ tovuduts
[08/28/2008|07:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[07/30/2008|04:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[10/06/2008|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WLInstaller
[10/06/2008|04:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo!
[10/06/2008|04:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! Companion

[10/10/2008|12:48] C:\DOCUME~1\Cristian\APPLIC~1\ .bsnes
[08/28/2008|07:36] C:\DOCUME~1\Cristian\APPLIC~1\ acccore
[10/22/2008|04:24] C:\DOCUME~1\Cristian\APPLIC~1\ Adobe
[09/07/2008|06:01] C:\DOCUME~1\Cristian\APPLIC~1\ Ahead
[06/17/2008|01:12] C:\DOCUME~1\Cristian\APPLIC~1\ Apple Computer
[09/19/2008|12:35] C:\DOCUME~1\Cristian\APPLIC~1\ Audacity
[11/08/2008|12:52] C:\DOCUME~1\Cristian\APPLIC~1\ CopyTrans
[11/08/2008|12:49] C:\DOCUME~1\Cristian\APPLIC~1\ CopyTransControlCenter
[11/08/2008|02:45] C:\DOCUME~1\Cristian\APPLIC~1\ CopyTransDoctor
[11/08/2008|12:54] C:\DOCUME~1\Cristian\APPLIC~1\ CopyTransManager
[09/04/2008|02:16] C:\DOCUME~1\Cristian\APPLIC~1\ DivX
[05/29/2008|06:03] C:\DOCUME~1\Cristian\APPLIC~1\ FMZilla
[04/28/2008|03:46] C:\DOCUME~1\Cristian\APPLIC~1\ Google
[08/21/2008|04:18] C:\DOCUME~1\Cristian\APPLIC~1\ Haihaisoft Universal Player
[11/08/2008|02:44] C:\DOCUME~1\Cristian\APPLIC~1\ iCloner
[06/17/2006|04:41] C:\DOCUME~1\Cristian\APPLIC~1\ Identities
[11/12/2008|07:46] C:\DOCUME~1\Cristian\APPLIC~1\ LimeWire
[04/28/2008|03:41] C:\DOCUME~1\Cristian\APPLIC~1\ Macromedia
[10/04/2008|10:23] C:\DOCUME~1\Cristian\APPLIC~1\ Malwarebytes
[08/30/2008|11:30] C:\DOCUME~1\Cristian\APPLIC~1\ Microsoft
[08/27/2008|07:34] C:\DOCUME~1\Cristian\APPLIC~1\ Mozilla
[10/06/2008|12:31] C:\DOCUME~1\Cristian\APPLIC~1\ MSNInstaller
[08/01/2008|03:18] C:\DOCUME~1\Cristian\APPLIC~1\ Power Mixer
[09/04/2008|02:16] C:\DOCUME~1\Cristian\APPLIC~1\ Publish Providers
[09/05/2008|03:46] C:\DOCUME~1\Cristian\APPLIC~1\ Real
[10/23/2008|08:37] C:\DOCUME~1\Cristian\APPLIC~1\ Screaming Bee
[10/21/2008|07:18] C:\DOCUME~1\Cristian\APPLIC~1\ SharePod
[06/20/2008|04:13] C:\DOCUME~1\Cristian\APPLIC~1\ Snapfish
[09/04/2008|02:15] C:\DOCUME~1\Cristian\APPLIC~1\ Sony
[05/26/2008|12:03] C:\DOCUME~1\Cristian\APPLIC~1\ Sun
[11/14/2008|06:17] C:\DOCUME~1\Cristian\APPLIC~1\ SUPERAntiSpyware.com
[11/09/2008|06:42] C:\DOCUME~1\Cristian\APPLIC~1\ Thinstall
[10/04/2008|08:46] C:\DOCUME~1\Cristian\APPLIC~1\ TmpRecentIcons
[11/14/2008|03:17] C:\DOCUME~1\Cristian\APPLIC~1\ U3
[09/02/2008|12:46] C:\DOCUME~1\Cristian\APPLIC~1\ Uniblue
[10/17/2008|12:36] C:\DOCUME~1\Cristian\APPLIC~1\ uTorrent
[06/03/2008|12:13] C:\DOCUME~1\Cristian\APPLIC~1\ Viewpoint
[08/02/2008|09:25] C:\DOCUME~1\Cristian\APPLIC~1\ WinFF
[08/05/2008|04:59] C:\DOCUME~1\Cristian\APPLIC~1\ WinRAR
[09/03/2008|03:59] C:\DOCUME~1\Cristian\APPLIC~1\ Xilisoft Corporation
[10/06/2008|04:56] C:\DOCUME~1\Cristian\APPLIC~1\ yahoo!

[06/17/2006|04:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[06/19/2006|01:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft

[10/22/2008|07:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[09/06/2008|11:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\ SACore

[06/17/2006|04:45] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[11/14/2008 12:00 PM][–a——] C:\WINDOWS\tasks\Schedule Task Weekly.job
[09/06/2008 11:19 AM][–a——] C:\WINDOWS\tasks\McDefragTask.job
[11/01/2008 12:00 AM][–a——] C:\WINDOWS\tasks\McQcTask.job
[10/30/2008 10:45 PM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/14/2008 11:33 AM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/10/2004 02:00 PM][-r-h—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[08/02/2008|09:50] C:\Program Files\ 7-Zip
[09/30/2008|08:41] C:\Program Files\ Adobe
[08/05/2008|05:34] C:\Program Files\ Apple Software Update
[07/22/2008|07:30] C:\Program Files\ Audacity
[10/20/2008|09:02] C:\Program Files\ Bonjour
[04/25/2008|04:45] C:\Program Files\ Canon
[04/25/2008|04:41] C:\Program Files\ CanonBJ
[11/13/2008|10:38] C:\Program Files\ Common Files
[06/17/2006|04:37] C:\Program Files\ ComPlus Applications
[04/29/2008|05:19] C:\Program Files\ CONEXANT
[08/07/2008|04:28] C:\Program Files\ Datel
[09/15/2008|08:55] C:\Program Files\ DivX
[10/06/2008|12:30] C:\Program Files\ DNA
[10/31/2008|09:36] C:\Program Files\ Enigma Software Group
[10/30/2008|03:37] C:\Program Files\ EphPod
[10/04/2008|09:18] C:\Program Files\ Google
[08/17/2008|12:02] C:\Program Files\ Haihaisoft Universal Player
[09/15/2008|08:38] C:\Program Files\ InstallShield Installation Information
[08/14/2008|07:45] C:\Program Files\ Internet Explorer
[10/20/2008|09:02] C:\Program Files\ iPod
[10/20/2008|09:02] C:\Program Files\ iTunes
[10/08/2008|08:11] C:\Program Files\ Java
[11/08/2008|08:00] C:\Program Files\ LimeWire
[10/04/2008|10:22] C:\Program Files\ Malwarebytes' Anti-Malware
[09/06/2008|04:23] C:\Program Files\ McAfee
[09/06/2008|04:23] C:\Program Files\ McAfee.com
[08/14/2008|07:45] C:\Program Files\ Messenger
[04/25/2008|12:59] C:\Program Files\ Microsoft ActiveSync
[09/19/2008|12:48] C:\Program Files\ microsoft frontpage
[04/25/2008|12:59] C:\Program Files\ Microsoft Office
[09/03/2008|03:38] C:\Program Files\ Microsoft SQL Server
[04/25/2008|12:58] C:\Program Files\ Microsoft Visual Studio
[08/31/2008|02:03] C:\Program Files\ Microsoft Works
[04/25/2008|12:57] C:\Program Files\ Microsoft.NET
[04/25/2008|12:31] C:\Program Files\ Movie Maker
[11/14/2008|06:16] C:\Program Files\ Mozilla Firefox
[04/25/2008|06:38] C:\Program Files\ MSN
[06/17/2006|04:35] C:\Program Files\ MSN Gaming Zone
[08/07/2008|04:30] C:\Program Files\ MSXML 4.0
[10/08/2008|09:16] C:\Program Files\ MSXML 6.0
[04/25/2008|12:49] C:\Program Files\ Nero
[04/25/2008|12:31] C:\Program Files\ NetMeeting
[10/04/2008|10:55] C:\Program Files\ ngksggc
[09/30/2008|08:39] C:\Program Files\ NOS
[11/13/2008|10:37] C:\Program Files\ OJOsoft
[04/25/2008|12:18] C:\Program Files\ Online Services
[04/26/2008|08:46] C:\Program Files\ Outlook Express
[09/10/2008|01:37] C:\Program Files\ Palm
[09/05/2008|10:16] C:\Program Files\ Panda Security
[10/20/2008|09:01] C:\Program Files\ QuickTime
[09/05/2008|03:25] C:\Program Files\ Real
[11/11/2008|08:16] C:\Program Files\ Real Alternative
[08/04/2008|02:50] C:\Program Files\ Realtek AC97
[10/27/2008|03:00] C:\Program Files\ RegCure
[10/27/2008|02:59] C:\Program Files\ Registry Easy
[10/21/2008|02:13] C:\Program Files\ RogueRemover FREE
[11/14/2008|06:29] C:\Program Files\ RogueRemover PRO
[09/06/2008|11:25] C:\Program Files\ SiteAdvisor
[10/31/2008|08:51] C:\Program Files\ Spybot - Search & Destroy
[11/14/2008|06:18] C:\Program Files\ SUPERAntiSpyware
[09/05/2008|04:01] C:\Program Files\ The Weather Channel FW
[10/18/2008|01:39] C:\Program Files\ Trend Micro
[09/02/2008|12:46] C:\Program Files\ Uniblue
[09/03/2008|03:39] C:\Program Files\ Uninstall Information
[04/25/2008|01:04] C:\Program Files\ Webroot
[07/30/2008|04:37] C:\Program Files\ Windows Media Connect 2
[07/30/2008|04:37] C:\Program Files\ Windows Media Player
[04/25/2008|12:31] C:\Program Files\ Windows NT
[06/17/2006|04:36] C:\Program Files\ Windows Plus
[06/17/2006|04:39] C:\Program Files\ WindowsUpdate
[11/08/2008|12:49] C:\Program Files\ WindSolutions
[06/17/2006|04:41] C:\Program Files\ xerox
[10/21/2008|02:13] C:\Program Files\ XoftSpySE
[10/06/2008|04:53] C:\Program Files\ Yahoo!

——————–\\ Listing Folders in C:\Program Files\Common Files

[09/30/2008|08:43] C:\Program Files\Common Files\ Adobe
[04/25/2008|12:51] C:\Program Files\Common Files\ Ahead
[08/28/2008|08:20] C:\Program Files\Common Files\ AOL
[10/20/2008|09:01] C:\Program Files\Common Files\ Apple
[11/13/2008|10:38] C:\Program Files\Common Files\ Common Share
[04/25/2008|12:59] C:\Program Files\Common Files\ DESIGNER
[10/06/2008|12:11] C:\Program Files\Common Files\ Download Manager
[10/06/2008|12:29] C:\Program Files\Common Files\ DVDVideoSoft
[07/30/2008|07:04] C:\Program Files\Common Files\ eSellerate
[08/21/2008|12:16] C:\Program Files\Common Files\ InstallShield
[05/25/2008|12:07] C:\Program Files\Common Files\ Java
[04/25/2008|12:59] C:\Program Files\Common Files\ L&H
[04/25/2008|04:52] C:\Program Files\Common Files\ LightScribe
[09/06/2008|11:20] C:\Program Files\Common Files\ McAfee
[09/03/2008|03:34] C:\Program Files\Common Files\ Microsoft Shared
[06/17/2006|04:38] C:\Program Files\Common Files\ MSSoap
[06/19/2006|01:36] C:\Program Files\Common Files\ New Boundary
[06/16/2006|09:31] C:\Program Files\Common Files\ ODBC
[09/05/2008|03:26] C:\Program Files\Common Files\ Real
[04/25/2008|12:31] C:\Program Files\Common Files\ Services
[06/16/2006|09:31] C:\Program Files\Common Files\ SpeechEngines
[04/26/2008|08:46] C:\Program Files\Common Files\ System
[08/30/2008|11:28] C:\Program Files\Common Files\ WindowsLiveInstaller
[11/14/2008|06:17] C:\Program Files\Common Files\ Wise Installation Wizard
[09/05/2008|03:26] C:\Program Files\Common Files\ xing shared

——————–\\ Process

( 39 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-14 18:34:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\Cristian\Application Data\uTorrent\XoftSpySE v.4.33 Anti-Spyware +keygen (Professional ).rar.torrent

[F:28][D:15]-> C:\DOCUME~1\Cristian\LOCALS~1\Temp
[F:2][D:0]-> C:\DOCUME~1\Cristian\Cookies
[F:194][D:20]-> C:\DOCUME~1\Cristian\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Fri 11/14/2008|18:35 - Option : [1]

——————–\\ Scan completed at 18:35:31

Rorschach112

Post #4November 14, 2008, 11:46 PM UTC

You got infected because you downloaded cracks

Please download the OTMoveIt3 by OldTimer or from here.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ovefwfif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\tovuduts
C:\Program Files\ngksggc
C:\DOCUME~1\Cristian\Application Data\uTorrent\XoftSpySE v.4.33 Anti-Spyware +keygen (Professional ).rar.torrent

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<

goku2000u

Post #5November 15, 2008, 2:40 AM UTC

I almost panicked when I restarted my computer and saw that no icons, Start button, and toolbars were appearing, because I had that problem last year and we only had to use Task Manager until it was totally wrecked. Sorry, I got carried away.

Okay, this log is from the C:\_OTMoveIt\MovedFiles folder:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\DOCUME~1\ALLUSE~1\APPLIC~1\ovefwfif moved successfully.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\tovuduts moved successfully.
C:\Program Files\ngksggc moved successfully.
C:\DOCUME~1\Cristian\Application Data\uTorrent\XoftSpySE v.4.33 Anti-Spyware +keygen (Professional ).rar.torrent moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Cristian\LOCALS~1\Temp\etilqs_nEJImWllpPI0J4Rgtd3k scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\mcmsc_2VyQwmaYjElpvna scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_hRudrde1kg4USmL scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_N4jbxLyJ46abfCd scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_HvmqtNAvFc5uPsM scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_hZS1UTSyjMgi9wi scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_prplBVdO8ETznce scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_RXCz0ZCiYcvTOTU scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11142008_211547

Files moved on Reboot…
File C:\DOCUME~1\Cristian\LOCALS~1\Temp\etilqs_nEJImWllpPI0J4Rgtd3k not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\mcmsc_2VyQwmaYjElpvna not found!
File C:\WINDOWS\temp\mcmsc_hRudrde1kg4USmL not found!
C:\WINDOWS\temp\mcmsc_N4jbxLyJ46abfCd moved successfully.
C:\WINDOWS\temp\sqlite_HvmqtNAvFc5uPsM moved successfully.
C:\WINDOWS\temp\sqlite_hZS1UTSyjMgi9wi moved successfully.
C:\WINDOWS\temp\sqlite_prplBVdO8ETznce moved successfully.
C:\WINDOWS\temp\sqlite_RXCz0ZCiYcvTOTU moved successfully.
C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\urlclassifier3.sqlite moved successfully.

The next two logs were from the RSIT.exe:

Info.txt log:

info.txt logfile of random's system information tool 1.04 2008-11-14 21:36:23

======Uninstall list======

–>C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–>C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
–>C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
–>C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
–>C:\WINDOWS\UNNeroVision.exe /UNINSTALL
–>C:\WINDOWS\UNRecode.exe /UNINSTALL
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.57–>"C:\Program Files\7-Zip\Uninstall.exe"
Action Replay Code Manager–>"C:\Program Files\Datel\Action Replay Code Manager\unins000.exe"
Adobe Flash Player 10 Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Apple Mobile Device Support–>MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI Display Driver–>rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6–>"K:\Audacity\Audacity 1.3 Beta (Unicode)\Audacity\unins000.exe"
Audacity 1.3.5 (Unicode)–>"K:\Audacity\Audacity 1.3 Beta (Unicode)\unins000.exe"
Blaze Audio VoiceSFX Trial–>"K:\Audacity\VoiceSFX Trial\unins000.exe"
Bonjour–>MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Canon iP1700 User Registration–>C:\Program Files\Canon\IJEREG\iP1700\UNINST.EXE
Canon iP1700–>"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1700\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1700 /L0x0009
Canon My Printer–>C:\Program Files\Canon\MyPrinter\uninst.exe uninst.ini
Canon Utilities Easy-PhotoPrint–>C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CopyTrans Suite Remove Only–>C:\Program Files\WindSolutions\CopyTrans Suite\CopyTransControlCenter.exe uninstall
Easy-WebPrint–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
EphPod–>C:\PROGRA~1\EphPod\UNWISE.EXE C:\PROGRA~1\EphPod\INSTALL.LOG
Fighter Factory 1.0.9.2005 + Update Pack 1–>"K:\Mortal Kombat 4.2\mkp4.3_mine\Fighter Factory\unins000.exe"
Free RM to MP3 Converter 1.12–>"C:\Program Files\Free RM to MP3 Converter\unins000.exe"
getPlus® for Adobe–>"C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
Google Toolbar for Internet Explorer–>MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer–>regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
Haihaisoft Universal Player–>C:\Program Files\Haihaisoft Universal Player\Uninstall.exe
High Definition Audio Driver Package - KB888111–>"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 10 (KB903157)–>"C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB888795)–>"C:\WINDOWS\$NtUninstallKB888795$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB891593)–>"C:\WINDOWS\$NtUninstallKB891593$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB895961)–>"C:\WINDOWS\$NtUninstallKB895961$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB896256)–>"C:\WINDOWS\$NtUninstallKB896256$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB899337)–>"C:\WINDOWS\$NtUninstallKB899337$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB899510)–>"C:\WINDOWS\$NtUninstallKB899510$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB902841)–>"C:\WINDOWS\$NtUninstallKB902841$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB906569)–>"C:\WINDOWS\$NtUninstallKB906569$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB909095)–>"C:\WINDOWS\$NtUninstallKB909095$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB910728)–>"C:\WINDOWS\$NtUninstallKB910728$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB912024)–>"C:\WINDOWS\$NtUninstallKB912024$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB914440)–>"C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB914906)–>"C:\WINDOWS\$NtUninstallKB914906$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)–>"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)–>"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB935448)–>"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
iPod To Computer Transfer 4.0–>"K:\iPod To Computer Transfer\unins000.exe"
iTunes–>MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java™ SE Runtime Environment 6 Update 1–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
K-Lite Mega Codec Pack 3.7.5–>"C:\Program Files\Haihaisoft Universal Player\Codec\unins000.exe"
LADSPA_plugins-win-0.4.15–>"K:\Audacity\Plug-Ins\Plug-Ins\unins000.exe"
LimeWire PRO 4.18.3–>"C:\Program Files\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Malwarebytes' RogueRemover PRO–>"C:\Program Files\RogueRemover PRO\unins000.exe"
McAfee SecurityCenter–>C:\Program Files\McAfee\MSC\mcuninst.exe
Microsoft .NET Framework 1.0 Hotfix (KB930494)–>"C:\WINDOWS\$NtUninstallKB930494$\spuninst\spuninst.exe"
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003–>MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)–>MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MobileMe Control Panel–>MsiExec.exe /I{2604C0F9-BFD3-4BA0-9EB5-22537C648F03}
Mozilla Firefox (3.0.3)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN–>C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK–>MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB933579)–>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 7 Essentials–>MsiExec.exe /I{8867CEBD-E6C0-4C7A-83B3-9E45669A1033}
OJOsoft Total Video Converter–>"C:\Program Files\OJOsoft\uninstall.exe" "/U:C:\Program Files\OJOsoft\OJOsoft Total Video Converter\Uninstall\uninstall.xml"
Palm Desktop–>MsiExec.exe /X{870842F7-18BB-479D-A7B1-FE17E81AFF1A}
Panda ActiveScan 2.0–>C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
QuickTime–>MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
Real Alternative 1.60 Lite–>"C:\Program Files\Real Alternative\unins000.exe"
RealPlayer–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x9 -removeonly
Realtek High Definition Audio Driver–>RtlUpd.exe -r
RegCure 1.5.0.1–>C:\Program Files\RegCure\uninst.exe
Replay Music 3.35–>C:\WINDOWS\iun6002.exe "J:\irunin.ini"
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)–>"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)–>"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)–>"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)–>"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)–>"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896424)–>"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896688)–>"C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899589)–>"C:\WINDOWS\$NtUninstallKB899589$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)–>"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)–>"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)–>"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB904706)–>"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)–>"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)–>"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905915)–>"C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)–>"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908531)–>"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911280)–>"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)–>"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911567)–>"C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)–>"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912812)–>"C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912919)–>"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)–>"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)–>"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)–>"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB916281)–>"C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917344)–>"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)–>"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)–>"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918439)–>"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)–>"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)–>"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)–>"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)–>"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)–>"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)–>"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)–>"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)–>"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)–>"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)–>C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB923980)–>"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)–>"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)–>"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)–>"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)–>"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)–>"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)–>"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)–>"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)–>"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)–>"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)–>"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)–>"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)–>"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)–>"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)–>"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)–>"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)–>"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)–>"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)–>"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937894)–>"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)–>"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)–>"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)–>"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941693)–>"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)–>"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)–>"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)–>"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)–>"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB945553)–>"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)–>"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948590)–>"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948881)–>"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950749)–>"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Soft Data Fax Modem with SmartCP–>C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV;_2F20&SUBSYS;_200014F1\HXFSETUP.EXE -U -IPDRSLSM5K.inf
Sonic Encoders–>MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
Spy Sweeper–>C:\WINDOWS\unSpySweeper.exe
Spybot - Search & Destroy–>"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SUPERAntiSpyware Free Edition–>MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Uniblue RegistryBooster 2009–>"C:\Documents and Settings\All Users\Application Data\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\Uniblue RegistryBooster.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue RegistryBooster 2009–>C:\Documents and Settings\All Users\Application Data\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}\Uniblue RegistryBooster.exe
Update for Windows Media Format SDK (KB902344)–>"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"
Update for Windows Media Player 10 (KB910393)–>"C:\WINDOWS\$NtUninstallKB910393$\spuninst\spuninst.exe"
Update for Windows Media Player 10 (KB913800)–>"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
Update for Windows Media Player 10 (KB926251)–>"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)–>"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)–>"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB904942)–>"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)–>"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB912945)–>"C:\WINDOWS\$NtUninstallKB912945$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)–>"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)–>"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)–>"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)–>"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)–>"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB932823-v3)–>"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)–>"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)–>"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)–>"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update Rollup 2 for Windows XP Media Center Edition 2005–>C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
VST Bridge 1.1–>"C:\Program Files\Audacity\Plug-ins\VST Bridge\unins000.exe"
Windows Imaging Component–>"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 7–>"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format 11 runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin–>MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows XP Hotfix - KB886185–>C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Media Center Edition 2005 KB925766–>"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
Yahoo! Browser Services–>C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
Yahoo! Messenger–>C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar–>C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

=====HijackThis Backups=====

O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O21 - SSODL: xgpsarbm - {AD022588-EC19-4716-B438-FB5E9D5E8B6B} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O2 - BHO: winhost_app.winhost_appdll - {5E06398E-3017-467B-A399-18425A20F655} - C:\WINDOWS\winhost_app.dll

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: McAfee VirusScan

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0409
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

—————–EOF—————–

log.txt:

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-11-14 21:35:23
Microsoft Windows XP Professional Service Pack 2
System drive C: has 135 GB (88%) free of 153 GB
Total RAM: 382 MB (15% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:36:10 PM, on 11/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Cristian\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Cristian.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://windiwsfsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windiwsfsearch.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windiwsfsearch.com/ie6.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://windiwsfsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\Cristian\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O20 - AppInit_DLLs: ycshtb.dll wexyyv.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

–
End of file - 6189 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job
C:\WINDOWS\tasks\Schedule Task Weekly.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"DELDIR0.EXE"=C:\DOCUME~1\Cristian\LOCALS~1\Temp\DELDIR0.EXE C:\Program Files\McAfee\McAfee Shared Components\Guardian\ []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-10 15360]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-09-05 185896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Cristian^Start Menu^Programs^Startup^HotSync Manager.lnk]
C:\PROGRA~1\Palm\HOTSYNC.EXE [2003-07-16 299008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="ycshtb.dll wexyyv.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-09-29 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
"NoDispCPL"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoStartMenuMorePrograms"=0
"StartMenuLogOff"=0
"NoDrives"=0
"NoToolbarCustomize"=0
"NoSetFolders"=0
"NoResolveSearch"=1
"NoResolveTrack"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"J:\LimeWire\LimeWire.exe"="J:\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"J:\BitTorrent\bittorrent.exe"="J:\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Disabled:Run a DLL as an App"
"K:\RouterClient.exe"="K:\RouterClient.exe:*:Disabled:RouterClient"
"K:\LimeWire\LimeWire.exe"="K:\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"="C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Disabled:Nero ShowTime Essentials"
"C:\Program Files\Palm\HOTSYNC.EXE"="C:\Program Files\Palm\HOTSYNC.EXE:*:Disabled:HotSync® Manager Application"
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"K:\Free Music Zilla\FMZilla.exe"="K:\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla Module"
"J:\Free Music Zilla\FMZilla.exe"="J:\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla Module"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5786ddb7-1310-11dd-88ab-001676a30699}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com e:
shell\Open\command - E:\resycled\boot.com e:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5988d9d4-128d-11dd-88a7-001676a30699}]
shell\AutoRun\command - 1.bat
shell\explore\command - 1.bat
shell\open\command - 1.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4ce2b56-22af-11dd-88e5-001676a30699}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com e:
shell\Open\command - E:\resycled\boot.com e:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8777756-a5bb-11dd-8a08-001676a30699}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com e:
shell\Open\command - E:\resycled\boot.com e:

======List of files/folders created in the last 1 months======

2008-11-14 21:35:23 —-D—- C:\rsit
2008-11-14 21:15:47 —-D—- C:\_OTMoveIt
2008-11-14 18:31:40 —-A—- C:\lopR.txt
2008-11-14 18:29:45 —-D—- C:\Program Files\RogueRemover PRO
2008-11-14 18:13:14 —-D—- C:\Lop SD
2008-11-13 10:38:04 —-D—- C:\Program Files\Common Files\Common Share
2008-11-13 10:37:59 —-D—- C:\Program Files\OJOsoft
2008-11-11 20:16:02 —-D—- C:\Program Files\Real Alternative
2008-11-09 18:42:21 —-D—- C:\Documents and Settings\Cristian\Application Data\Thinstall
2008-11-08 20:00:34 —-D—- C:\Program Files\LimeWire
2008-11-08 14:45:11 —-D—- C:\Documents and Settings\Cristian\Application Data\CopyTransDoctor
2008-11-08 14:44:50 —-D—- C:\Documents and Settings\Cristian\Application Data\iCloner
2008-11-08 12:54:08 —-D—- C:\Documents and Settings\Cristian\Application Data\CopyTransManager
2008-11-08 12:50:30 —-D—- C:\Documents and Settings\Cristian\Application Data\CopyTrans
2008-11-08 12:49:25 —-D—- C:\Program Files\WindSolutions
2008-11-08 12:49:20 —-D—- C:\Documents and Settings\Cristian\Application Data\CopyTransControlCenter
2008-11-08 12:49:20 —-D—- C:\Documents and Settings\All Users\Application Data\CopyTransControlCenter
2008-11-02 21:53:53 —-A—- C:\WINDOWS\system32\devil.dll
2008-11-02 21:53:53 —-A—- C:\WINDOWS\system32\avisynth.dll
2008-11-01 15:27:28 —-A—- C:\WINDOWS\wininit.ini
2008-10-31 08:51:36 —-D—- C:\Program Files\Spybot - Search & Destroy
2008-10-31 08:51:36 —-D—- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-30 15:36:55 —-D—- C:\Program Files\EphPod
2008-10-30 11:50:57 —-SHD—- C:\found.001
2008-10-30 07:59:17 —-SHD—- C:\found.000
2008-10-27 15:00:56 —-D—- C:\Program Files\RegCure
2008-10-24 11:10:06 —-D—- C:\Program Files\Registry Easy
2008-10-23 21:20:27 —-SHD—- C:\Config.Msi
2008-10-23 20:50:39 —-D—- C:\vcs5BGEffects
2008-10-23 20:37:27 —-D—- C:\Documents and Settings\Cristian\Application Data\Screaming Bee
2008-10-23 20:35:35 —-D—- C:\Documents and Settings\All Users\Application Data\Screaming Bee
2008-10-23 13:08:22 —-A—- C:\Documents and Settings\Cristian\Application Data\VoiceSFX.ini
2008-10-21 19:18:58 —-D—- C:\Documents and Settings\Cristian\Application Data\SharePod
2008-10-21 15:26:13 —-RSHD—- C:\resycled
2008-10-20 21:03:02 —-A—- C:\WINDOWS\system32\GEARAspi.dll
2008-10-20 21:02:33 —-D—- C:\Program Files\iPod
2008-10-20 21:02:28 —-D—- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-20 21:02:06 —-D—- C:\Program Files\Bonjour
2008-10-20 21:00:54 —-D—- C:\Program Files\QuickTime
2008-10-18 13:39:10 —-D—- C:\Program Files\Trend Micro
2008-10-17 14:44:05 —-D—- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-10-17 14:43:40 —-D—- C:\Program Files\SUPERAntiSpyware
2008-10-17 14:43:40 —-D—- C:\Documents and Settings\Cristian\Application Data\SUPERAntiSpyware.com
2008-10-17 04:17:26 —-A—- C:\WINDOWS\system32\ifxueulu.exe
2008-10-16 13:59:29 —-A—- C:\WINDOWS\system32\egsywjer.exe
2008-10-15 13:58:42 —-A—- C:\WINDOWS\system32\xgsogpaw.exe
2008-10-15 11:31:56 —-A—- C:\WINDOWS\system32\smcutf.dll

======List of files/folders modified in the last 1 months======

2008-11-14 21:35:41 —-D—- C:\WINDOWS\Prefetch
2008-11-14 21:35:31 —-D—- C:\WINDOWS\Temp
2008-11-14 21:29:25 —-D—- C:\Program Files\Mozilla Firefox
2008-11-14 21:27:44 —-D—- C:\WINDOWS\Registration
2008-11-14 21:26:51 —-D—- C:\WINDOWS
2008-11-14 21:25:37 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-11-14 21:25:30 —-A—- C:\WINDOWS\ModemLog_PCI Soft Data Fax Modem with SmartCP.txt
2008-11-14 21:15:48 —-D—- C:\Program Files
2008-11-14 21:15:48 —-D—- C:\Documents and Settings\Cristian\Application Data\uTorrent
2008-11-14 18:53:06 —-D—- C:\Documents and Settings\Cristian\Application Data\U3
2008-11-14 18:52:49 —-D—- C:\Documents and Settings\Cristian\Application Data\LimeWire
2008-11-14 18:29:55 —-D—- C:\WINDOWS\system32\drivers
2008-11-14 18:20:04 —-D—- C:\WINDOWS\system32\CatRoot2
2008-11-14 18:18:20 —-SHD—- C:\WINDOWS\Installer
2008-11-14 18:17:29 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2008-11-14 14:19:16 —-A—- C:\WINDOWS\NeroDigital.ini
2008-11-13 13:38:06 —-RSH—- C:\boot.ini
2008-11-13 13:38:06 —-A—- C:\WINDOWS\win.ini
2008-11-13 13:38:05 —-A—- C:\WINDOWS\system.ini
2008-11-13 13:38:02 —-D—- C:\WINDOWS\pss
2008-11-13 10:53:30 —-HD—- C:\WINDOWS\inf
2008-11-13 10:38:04 —-D—- C:\WINDOWS\system32
2008-11-13 10:38:04 —-D—- C:\Program Files\Common Files
2008-11-07 14:29:32 —-D—- C:\WINDOWS\system32\Lang
2008-11-02 08:03:12 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-31 09:36:17 —-D—- C:\Program Files\Enigma Software Group
2008-10-29 13:01:26 —-D—- C:\WINDOWS\network diagnostic
2008-10-27 15:00:51 —-RSHDC—- C:\WINDOWS\system32\dllcache
2008-10-24 15:27:19 —-D—- C:\WINDOWS\system32\config
2008-10-24 15:26:57 —-D—- C:\WINDOWS\system32\wbem
2008-10-24 15:24:30 —-D—- C:\WINDOWS\system32\Restore
2008-10-24 11:29:28 —-SD—- C:\WINDOWS\Tasks
2008-10-23 20:37:53 —-D—- C:\WINDOWS\system32\CatRoot
2008-10-22 21:19:53 —-D—- C:\WINDOWS\Debug
2008-10-22 16:24:54 —-D—- C:\Documents and Settings\Cristian\Application Data\Adobe
2008-10-21 14:13:37 —-D—- C:\Program Files\XoftSpySE
2008-10-20 21:03:02 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-10-20 21:02:58 —-D—- C:\Program Files\iTunes
2008-10-20 21:01:04 —-D—- C:\Program Files\Common Files\Apple
2008-10-20 21:00:50 —-D—- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-10-17 17:08:33 —-RSD—- C:\WINDOWS\assembly
2008-10-17 04:17:23 —-A—- C:\WINDOWS\system32\eb5c73bf-.txt
2008-10-15 11:27:07 —-SH—- C:\WINDOWS\system32\cwstqojm.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-10 36096]
R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2008-06-27 207656]
R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2008-06-02 120136]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-05 12544]
R3 admjoy;Aureal Game Port Enumerator; C:\WINDOWS\system32\DRIVERS\admjoy.sys [2004-08-03 10880]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-09-29 2456064]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-07-22 1035008]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2005-07-22 231168]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-09-23 3966976]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2008-06-27 79240]
R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2008-06-27 35240]
R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2008-06-27 40488]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-10 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-10 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 26496]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-07-22 717952]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-10 14848]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-03 60800]
S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-10 9600]
S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2008-06-20 34152]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 Ndisprot;ArcNet NDIS Protocol Driver; \??\C:\WINDOWS\system32\drivers\Ndisprot.sys []
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-03 61824]
S3 SCREAMINGBDRIVER;Screaming Bee Audio; C:\WINDOWS\system32\drivers\ScreamingBAudio.sys []
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-10 67584]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-10 31616]
S3 USBIO;USBIO Driver (usbio.sys); C:\WINDOWS\System32\Drivers\usbio.sys [2001-05-07 19805]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-10 20480]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-10 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-09-29 483328]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-04-10 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-09-24 61440]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-06-21 792184]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2008-07-18 2482848]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2008-07-09 358736]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2008-06-20 144704]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\McAfee\MSK\MskSrver.exe [2008-07-09 25416]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [2006-06-19 65536]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2008-06-20 605512]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 getPlus® Helper;getPlus® Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-28 138168]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2008-06-20 361800]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2004-08-10 14336]
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR []
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR []
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-10 14336]

—————–EOF—————–

Rorschach112

Post #6November 15, 2008, 1:18 PM UTC

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O20 - AppInit_DLLs: ycshtb.dll wexyyv.dll

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Please download the OTMoveIt3 by OldTimer or from here.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5786ddb7-1310-11dd-88ab-001676a30699}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5988d9d4-128d-11dd-88a7-001676a30699}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4ce2b56-22af-11dd-88e5-001676a30699}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8777756-a5bb-11dd-8a08-001676a30699}]

:files
C:\WINDOWS\system32\ifxueulu.exe
C:\WINDOWS\system32\egsywjer.exe
C:\WINDOWS\system32\xgsogpaw.exe
C:\WINDOWS\system32\smcutf.dll
C:\found.001
C:\found.000
C:\resycled



:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

goku2000u

Post #7November 15, 2008, 4:12 PM UTC

Next logs - Moveit! logs: ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I\\ deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5786ddb7-1310-11dd-88ab-001676a30699}\\ deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5988d9d4-128d-11dd-88a7-001676a30699}\\ deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4ce2b56-22af-11dd-88e5-001676a30699}\\ deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8777756-a5bb-11dd-8a08-001676a30699}\\ deleted successfully. ========== FILES ========== C:\WINDOWS\system32\ifxueulu.exe moved successfully. C:\WINDOWS\system32\egsywjer.exe moved successfully. C:\WINDOWS\system32\xgsogpaw.exe moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\system32\smcutf.dll C:\WINDOWS\system32\smcutf.dll NOT unregistered. C:\WINDOWS\system32\smcutf.dll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\resources\media\img moved successfully. C:\found.001\dir0002.chk\Adobe CS3\resources\media\css moved successfully. C:\found.001\dir0002.chk\Adobe CS3\resources\media moved successfully. C:\found.001\dir0002.chk\Adobe CS3\resources\common\scripts moved successfully. C:\found.001\dir0002.chk\Adobe CS3\resources\common\alert moved successfully. C:\found.001\dir0002.chk\Adobe CS3\resources\common moved successfully. C:\found.001\dir0002.chk\Adobe CS3\resources moved successfully. C:\found.001\dir0002.chk\Adobe CS3\redist moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\BridgeStartMeeting moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeXMPPanelsAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeWinSoftLinguisticsPluginAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeVersionCueClient3All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeTypeSupportAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeStockPhotos1.5All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobePhotoshop10en_US moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobePDFSettingsNAEU moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobePDFL8All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeLinguisticsAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeHelpViewerAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeFontsAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeExtendScriptToolKitAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3 moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeDeviceCentralAll\oem moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeDeviceCentralAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeDefaultLanguageCS3All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeColorPhotoshopAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeColorNA_RecommendedAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeColorCommonSetAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeCMapsAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeCameraRaw4.0All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeBridge2All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeAUM5.1All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeAssetServices3All moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads\AdobeALMAnchorServiceAll moved successfully. C:\found.001\dir0002.chk\Adobe CS3\payloads moved successfully. C:\found.001\dir0002.chk\Adobe CS3 moved successfully. C:\found.001\dir0002.chk moved successfully. C:\found.001\dir0001.chk moved successfully. C:\found.001\dir0000.chk moved successfully. C:\found.001 moved successfully. C:\found.000\dir0002.chk moved successfully. C:\found.000\dir0001.chk\update moved successfully. C:\found.000\dir0001.chk\SP2QFE moved successfully. C:\found.000\dir0001.chk moved successfully. C:\found.000\dir0000.chk\update moved successfully. C:\found.000\dir0000.chk\SP2QFE moved successfully. C:\found.000\dir0000.chk moved successfully. C:\found.000 moved successfully. C:\resycled moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Cristian\LOCALS~1\Temp\etilqs_grnbkzyU3f2zAG1XpnLN scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\mcmsc_X0Ai2Y18qyJ7cw9 scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\sqlite_8QSjlcxoKg7YP8V scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\sqlite_FVmHmM49EZpLDCq scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\sqlite_qH5vbYBInEC7ZH7 scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\sqlite_VJp2w4fQ5DeYuOs scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\urlclassifier3.sqlite scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11152008_110205 Files moved on Reboot… File C:\DOCUME~1\Cristian\LOCALS~1\Temp\etilqs_grnbkzyU3f2zAG1XpnLN not found! File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot. File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot. C:\WINDOWS\temp\mcmsc_X0Ai2Y18qyJ7cw9 moved successfully. C:\WINDOWS\temp\sqlite_8QSjlcxoKg7YP8V moved successfully. C:\WINDOWS\temp\sqlite_FVmHmM49EZpLDCq moved successfully. C:\WINDOWS\temp\sqlite_qH5vbYBInEC7ZH7 moved successfully. C:\WINDOWS\temp\sqlite_VJp2w4fQ5DeYuOs moved successfully. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Cristian\Local Settings\Application Data\Mozilla\Firefox\Profiles\xlhcav6r.default\urlclassifier3.sqlite moved successfully. But as for the RSIT, I ran it, and it says "Autolt Error - Line -1 Error: Error parsing function call." and it closes on me.

Rorschach112

Post #8November 15, 2008, 4:57 PM UTC

Hello

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

goku2000u

Post #9November 17, 2008, 5:14 PM UTC

Hello, here is my Malwarebytes log: Malwarebytes' Anti-Malware 1.28 Database version: 1134 Windows 5.1.2600 Service Pack 2 11/17/2008 11:31:42 AM mbam-log-2008-11-17 (11-31-42).txt Scan type: Quick Scan Objects scanned: 48781 Time elapsed: 7 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 4 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger.H) -> Data: kdfqn.exe -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17d69d6d-12ff-4389-acee-92491a36a37d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.195;85.255.112.122 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{17d69d6d-12ff-4389-acee-92491a36a37d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.195;85.255.112.122 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{17d69d6d-12ff-4389-acee-92491a36a37d}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.195;85.255.112.122 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\kdfqn.exe (Rootkit.DNSChanger.H) -> Delete on reboot. I am using a McAfee Anti-Virus, so I was wondering if it was okay to go to the Kapersky site, I already went there and downloaded and all, and went to My Computer - Scan and opened McAfee and it doesn't really help scanning for virus.

Rorschach112

Post #10November 17, 2008, 6:11 PM UTC

Yes its safe, post the Kaspersky log

goku2000u

Post #11November 17, 2008, 8:36 PM UTC

Okay here it is, but something went wrong and I'm not sure what it was. I'm sure there were more to scanned but when I got back from going out, it was an 1 hour and a half of scanning done. But here it is.

——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Monday, November 17, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, November 17, 2008 17:02:24 Records in database: 1390042 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ F:\ G:\ H:\ I:\ J:\ K:\ Scan statistics: Files scanned: 29055 Threat name: 2 Infected objects: 2 Suspicious objects: 0 Duration of the scan: 01:45:07 File name / Threat name / Threats count C:\autorun.inf Infected: Worm.Win32.AutoRun.nuu 1 C:\Documents and Settings\Cristian\Local Settings\Temp\tmp442.tmp Infected: Trojan-Downloader.Win32.Agent.ahcg 1

Rorschach112

Post #12November 17, 2008, 10:06 PM UTC

Hello

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

goku2000u

Post #13November 17, 2008, 11:05 PM UTC

The Combofix just gave me a Trojan or some sort. Because after I saved it to my desktop, it just created a folder in C:\(bunch of letters and numbers) and even the virus protection is disabled. So, when I tried it again, it said "Combo fix is ready to scan" or something, and then my computer inside it made a *beep* noise so I exit out of that quickly as possible, because I don't know what that was.

Rorschach112

Post #14November 17, 2008, 11:07 PM UTC

Run it again

goku2000u

Post #15November 18, 2008, 8:33 PM UTC

It did the error again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Internet Server Sometimes Broken

✨ Ask AI

Ask AI