[yoichi_hiruma21]

uh.. and one more thing. when i double-click my c drive, an error occurs. it says " cannot find peanut.vbs." what does it mean?

thanks again..

[Advertisements]

Please re read my previous post and follow those directions.
I cannot help you if you do not follow the directions.

Do the OTMove it instructions and we will go from there.

[kahdah]

Please re read my previous post and follow those directions.
I cannot help you if you do not follow the directions.

Do the OTMove it instructions and we will go from there.

[yoichi_hiruma21]

Oops! I forgot to post the avenger log. here it is...

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\oiyyjmfm

*******************

Script file located at: \??\C:\WINDOWS\ypyfhnfu.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\Documents and Settings\All Users\Documents\My Music\My Music.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\My Music\My Playlists\My Playlists.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Sample Music.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\000C3619\000C3619.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Sample Playlists.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sample Pictures.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe deleted successfully.
File C:\Documents and Settings\All Users\Documents\New Folder.exe deleted successfully.
File C:\peanut.bat deleted successfully.
File C:\peanut.reg deleted successfully.
File C:\peanut.vbs deleted successfully.
File C:\Pictures.exe deleted successfully.
File C:\Program Files\Adobe\Grisoft\AVG7\AVG7.exe deleted successfully.
File C:\WINDOWS\RVHOST.exe deleted successfully.
File C:\WINDOWS\system32\peanut.bat deleted successfully.
File C:\WINDOWS\system32\peanut.reg deleted successfully.
File C:\WINDOWS\system32\peanut.vbs deleted successfully.
File E:\peanut.bat deleted successfully.
File E:\peanut.reg deleted successfully.
File E:\peanut.vbs deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[kahdah]

• 1 - Flash Drive Disinfector
  Download Flash_Disinfector.exe by sUBs from >here< and save it to your desktop.
• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

[yoichi_hiruma21]

Here's the OTMoveIt log..

File/Folder C:\Documents and Settings\All Users\Documents\My Music\My Music.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\My Music\My Playlists\My Playlists.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Sample Music.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\000C3619\000C3619.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Sample Playlists.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sample Pictures.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe not found.
File/Folder C:\Documents and Settings\All Users\Documents\New Folder.exe not found.
File/Folder C:\peanut.bat not found.
File/Folder C:\peanut.reg not found.
File/Folder C:\peanut.vbs not found.
File/Folder C:\Pictures.exe not found.
File/Folder C:\Program Files\Adobe\Grisoft\AVG7\AVG7.exe not found.
File/Folder C:\WINDOWS\RVHOST.exe not found.
File/Folder C:\WINDOWS\system32\peanut.bat not found.
File/Folder C:\WINDOWS\system32\peanut.reg not found.
File/Folder C:\WINDOWS\system32\peanut.vbs not found.
File/Folder E:\peanut.bat not found.
File/Folder E:\peanut.reg not found.
File/Folder E:\peanut.vbs not found.

OTMoveIt2 v1.0.20 log created on 02212008_112916

[kahdah]

Did you run the Flash Disinfector?
If so is the C:\drive opening issue fixed?

[yoichi_hiruma21]

Yeah, and thanks a lot. So, what's the next procedure?

[kahdah]

Okay please do not pm me everytime you post.
It is better for you to post it here so others can see.
====================================
Please delete C:\AVenger and C:\SDFix.

Cleanup::

• Make sure you have an Internet Connection.
• Double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
• Click on the CleanUp! button
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

======================================
Check to see if AVG antivirus runs anymore if it does not then redownload it.

===============================================================
Delete any other tools left over that we used.
===============================
Then I will need you to reset your System Restore points, please note that you will need to log into your computer with an account which has full administrator access.
You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.
Click on *Start
Right-click *My Computer
Click *Properties
Click the *System Restore tab
Check *Turn off System Restore
Click *Apply, and then click *OK.

2. Reboot.

3. Turn ON System Restore.
Click on *Start
Right-click *My Computer
Click *Properties
*UN-Check *Turn off System Restore*
Check *Turn on System Restore
Click *Apply, and then click *OK.


How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb;en-us;310405
================================================================================
=
After that this log is clean and you can post the log from your other computer here in this thread.

[yoichi_hiruma21]

First of all, I'd like to deeply apologize for sending you a message every time I post. It won't happen again.

Wow! Than you very much. I just have a question though; why did I have to turn off and turn on the system restore in my computer. And another thing, the hijack this log I have from my other computer was retrieved yesterday. Do I have to generate a new one or that's just fine?

[kahdah]

Turning off system restore creates a clean restore point.
For example if you still had infected restore points and you did a system restore then guess what after you did it you would be re-infected.
=====================================
I would like a new Hijackthis log please as many changes can happen within a day when it comes to malware.
Thanks.

[yoichi_hiruma21]

Uh, one more thing, my messenger is infrected with a virus or something. It keeps on sending my chatmates some weird languages like nornatok bunga, something like that. what's wrong with it?
here's my new hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:02:41 AM, on 2/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RVHOST.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\VMSnap3.EXE
C:\WINDOWS\Domino.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\RVHOST.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RVHOST.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\Art\brontok-washer\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.macromedia.com/go/getflash
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe RVHOST.exe
F2 - REG:system.ini: UserInit=userinit.exe,peanut.bat
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\RVHOST.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6533 bytes

[kahdah]

Your computer is infected wait until we are done and see if it fixes the problem.
=============================================
Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
• Finally copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log

====================
Next:

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Post that log in your next reply.

(Note if you cannot open the log it produces then right click on it and choose rename.
Rename it to .txt and you will be able to open it)
===================================
Then:
Post a new Hijackthis log along with the other logs and we will go from there.

[yoichi_hiruma21]

Dr WebCureit:

peanut.vbs;c:\windows\system32;VBS.Generic.570;Deleted.;
podcast.exe;C:\Documents and Settings\RM16\My Documents;Win32.HLLW.Texmer.45;Incurable.Moved.;
peanut.vbs;C:\;VBS.Generic.570;Deleted.;

SDFix:


SDFix: Version 1.143

Run by RM16 on Fri 02/22/2008 at 09:46 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\RM16\Desktop\Art\SDFix

Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Checking Files:

Trojan Files Found:

C:\autorun.inf - Deleted
C:\WINDOWS\system32\setting.ini - Deleted
C:\autorun.inf - Deleted





Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 10:03:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"="C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe:*:Enabled:Camfrog Client Module"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:

C:\autorun.inf Found
C:\autorun.inf Found

File Backups: - C:\DOCUME~1\RM16\Desktop\Art\SDFix\backups\backups.zip

Files with Hidden Attributes:

Thu 6 Sep 2007 532 A.SHR --- "C:\peanut.reg"
Thu 6 Sep 2007 532 A.SHR --- "C:\WINDOWS\system32\peanut.reg"
Tue 29 Jan 2008 789,384 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4b6ccd5ccf72ffca11e7f7e0165f2082\BIT23.tmp"
Tue 29 Jan 2008 153,252 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6f0fd10fc234123bcdf54ebca4b84cbd\BIT206.tmp"
Tue 29 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c1629c0055ecd8b9ebbaad25bf8f7414\BIT2.tmp"
Tue 29 Jan 2008 490,736 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c23140ab2b4cffaee396a230df8b1229\BIT228.tmp"
Tue 29 Jan 2008 1,193,200 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f934b30a3337b488590ef3c1f3bbfd68\BIT1A.tmp"
Tue 29 Jan 2008 611,592 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fa53e640686f7f15b5ee3f532304b804\BITC.tmp"
Mon 28 Jan 2008 295,812 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\080070f6461c8001578e5e4cd4bb024b\download\BITA.tmp"
Tue 29 Jan 2008 1,767,035 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2abaeb659824de5967ddf7181c6befdb\download\BIT6.tmp"
Tue 29 Jan 2008 830,133 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\86c1313b3b7233a513215d577f5db5c4\download\BIT4C.tmp"
Tue 29 Jan 2008 211,964 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8a37f70e90784c333642cb76a8881df8\download\BIT8.tmp"
Tue 29 Jan 2008 124,335 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c1b0851ac9312d2f7e1ab716c11967b5\download\BIT1C.tmp"
Tue 29 Jan 2008 685,552 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d8816d09f86abbe0c321ddc90d5c0948\download\BIT7.tmp"
Tue 29 Jan 2008 49,720 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ee52836d5c671146809a1dc54498be1f\download\BIT59.tmp"

Finished!

New hijack this:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:06:03 AM, on 2/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\wscript.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\VMSnap3.EXE
C:\WINDOWS\Domino.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\RM16\Desktop\Art\brontok-washer\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.macromedia.com/go/getflash
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=userinit.exe,peanut.bat
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6325 bytes

Next?

[kahdah]

Please do an online scan with Kaspersky WebScanner
(This scanner is for use with internet explorer only)
Click on "Accept"

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

[yoichi_hiruma21]

Kaspersky report:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, February 22, 2008 1:46:34 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 22/02/2008
Kaspersky Anti-Virus database records: 575350
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
E:\

Scan Statistics:
Total number of scanned objects: 30506
Number of viruses found: 3
Number of infected objects: 134
Number of suspicious objects: 0
Duration of the scan process: 00:48:55

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Documents\My Music\My Music.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Music\My Music.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\My Music.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\My Music.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\My Playlists\My Playlists.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Music\My Playlists\My Playlists.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\My Playlists\My Playlists.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\My Playlists\My Playlists.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Sample Music.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Sample Music.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Sample Music.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Sample Music.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\000A79F2\000A79F2.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\000A79F2\000A79F2.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\000A79F2\000A79F2.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\000A79F2\000A79F2.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Sample Playlists.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Sample Playlists.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Sample Playlists.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\Sample Playlists.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sample Pictures.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sample Pictures.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sample Pictures.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sample Pictures.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\New Folder.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\All Users\Documents\New Folder.exe Embedded: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\New Folder.exe UPX: infected - 1 skipped
C:\Documents and Settings\All Users\Documents\New Folder.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\RM16\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\cert8.db Object is locked skipped
C:\Documents and Settings\RM16\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\RM16\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\history.dat Object is locked skipped
C:\Documents and Settings\RM16\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\key3.db Object is locked skipped
C:\Documents and Settings\RM16\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\parent.lock Object is locked skipped
C:\Documents and Settings\RM16\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\search.sqlite Object is locked skipped
C:\Documents and Settings\RM16\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\RM16\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped
C:\Documents and Settings\RM16\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\RM16\Desktop\Art\Art.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\Art.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\Art.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\Art.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\apps.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\apps.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\apps.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\apps.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\Replace.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\Replace.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\Replace.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\Replace.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\w2k\w2k.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\w2k\w2k.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\w2k\w2k.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\w2k\w2k.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\xp\xp.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\xp\xp.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\xp\xp.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\apps\Replace\xp\xp.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups\backupreg.zip/backupreg/backupreg.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups\backupreg.zip/backupreg/backupreg.exe Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups\backupreg.zip ZIP: infected - 2 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old1\backups.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old1\backups.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old1\backups.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old1\backups.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups_old1.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups_old1.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups_old1.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Desktop\Art\SDFix\backups_old2\backups_old1.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\DoctorWeb\Quarantine\podcast.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\Documents and Settings\RM16\DoctorWeb\Quarantine\podcast.exe Embedded: infected - 1 skipped
C:\Documents and Settings\RM16\DoctorWeb\Quarantine\podcast.exe UPX: infected - 1 skipped
C:\Documents and Settings\RM16\DoctorWeb\Quarantine\podcast.exe PE_Patch.UPX: infected - 1 skipped
C:\Documents and Settings\RM16\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Application Data\Mozilla\Firefox\Profiles\bw8vf3rp.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\History\History.IE5\MSHist012008022220080223\index.dat Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Temp\Perflib_Perfdata_82c.dat Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Temp\~DFF124.tmp Object is locked skipped
C:\Documents and Settings\RM16\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\RM16\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\RM16\ntuser.dat.LOG Object is locked skipped
C:\peanut.bat Infected: Virus.VBS.AutoRun.af skipped
C:\peanut.reg Infected: Virus.VBS.AutoRun.af skipped
C:\Program Files\Yahoo!\Messenger\logs\billing_RM16.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\client_RM16.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\network_RM16.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010696.exe/data0018/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010696.exe/data0018/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010696.exe/data0018/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010696.exe/data0018/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010696.exe/data0018/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010696.exe/data0018 Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010696.exe NSIS: infected - 6 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010698.exe/data0018/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010698.exe/data0018/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010698.exe/data0018/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010698.exe/data0018/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010698.exe/data0018/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010698.exe/data0018 Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP45\A0010698.exe NSIS: infected - 6 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027688.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027688.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027688.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027688.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027701.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027701.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027701.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0027701.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0028701.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0028701.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0028701.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0028701.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029702.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029702.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029702.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029702.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029723.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029723.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029723.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029723.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029738.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029738.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029738.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029738.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029743.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029743.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029743.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029743.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029790.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029790.exe Embedded: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029790.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP75\A0029790.exe PE_Patch.UPX: infected - 1 skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP76\A0029826.vbs Infected: Virus.VBS.AutoRun.af skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP76\A0029827.vbs Infected: Virus.VBS.AutoRun.af skipped
C:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP76\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\RVHOST.exe/script.au3 Infected: Worm.Win32.AutoIt.c skipped
C:\WINDOWS\RVHOST.exe Embedded: infected - 1 skipped
C:\WINDOWS\RVHOST.exe UPX: infected - 1 skipped
C:\WINDOWS\RVHOST.exe PE_Patch.UPX: infected - 1 skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\peanut.bat Infected: Virus.VBS.AutoRun.af skipped
C:\WINDOWS\system32\peanut.reg Infected: Virus.VBS.AutoRun.af skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\peanut.bat Infected: Virus.VBS.AutoRun.af skipped
E:\peanut.reg Infected: Virus.VBS.AutoRun.af skipped
E:\peanut.vbs Infected: Virus.VBS.AutoRun.af skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{14BFA410-93AB-44B1-8E5F-2458A842CE00}\RP76\change.log Object is locked skipped

Scan process completed.


What do I do next?