[Egwene]

Hello,

Do you have your windows CD ?

• 1 - Flash Drive Disinfector
  Download Flash_Disinfector.exe by sUBs from >here< and save it to your desktop.
• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

Then please reboot your computer and scan again with combofix and post me the new repport.

Regards,
Egwene.

Edited by Egwene, 25 October 2008 - 03:33 PM.

[Advertisements]

Hiya!

Yeah I do have it, but im not sure if it works cause it has some scratches on the back since it's pretty old.

Did what you told and here's what you needed

ComboFix 08-10-24.02 - com 2008-10-26 1:54:10.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1581 [GMT -8:00]
Running from: C:\Documents and Settings\com\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

H:\autorun.inf
H:\xih9.cmd

.
((((((((((((((((((((((((( Files Created from 2008-09-26 to 2008-10-26 )))))))))))))))))))))))))))))))
.

2008-10-24 20:38 . 2008-10-24 20:38 <DIR> d-------- C:\Documents and Settings\Administrator
2008-10-23 03:52 . 2008-10-23 03:52 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-10-23 03:52 . 2008-10-23 03:52 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-10-23 03:50 . 2008-10-23 03:50 577,024 --a------ C:\WINDOWS\system32\dllcache\user32.dll
2008-10-23 03:49 . 2008-10-23 03:49 <DIR> d-------- C:\WINDOWS\ERUNT
2008-10-23 02:56 . 2008-10-23 03:55 <DIR> d-------- C:\SDFix
2008-10-20 07:24 . 2008-10-26 01:49 <DIR> d-------- C:\Documents and Settings\com\Application Data\Xfire
2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\_OTMoveIt
2008-10-19 20:19 . 2008-10-19 20:19 <DIR> d-------- C:\Program Files\ERUNT
2008-10-19 07:28 . 2008-10-19 07:28 <DIR> d-------- C:\rsit
2008-10-19 07:09 . 2008-10-19 07:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-18 09:17 . 2008-10-18 09:17 <DIR> d-------- C:\Program Files\Alwil Software
2008-10-18 08:56 . 2008-10-18 08:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-10-16 05:01 . 2008-10-16 05:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\2DBoy
2008-10-08 16:48 . 2008-10-08 16:48 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-10-07 10:38 . 2008-10-07 10:38 <DIR> d-------- C:\Program Files\Hamachi
2008-10-07 08:15 . 2008-10-07 08:15 <DIR> d-------- C:\Program Files\Opera
2008-10-07 05:43 . 2008-10-07 05:43 <DIR> d-------- C:\Program Files\KeepV Converter
2008-10-06 04:40 . 2008-10-06 04:40 <DIR> d-------- C:\Program Files\Orbitdownloader
2008-10-03 22:26 . 2008-10-03 22:43 <DIR> d-------- C:\Program Files\MSECache
2008-10-03 21:13 . 2006-10-04 06:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-10-03 21:13 . 2006-10-04 06:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-10-03 21:13 . 2004-08-03 16:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-10-03 21:13 . 2006-10-04 06:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-10-03 21:12 . 2008-10-03 21:12 <DIR> d-------- C:\189016a8cff9dbed44
2008-09-30 06:36 . 2008-09-30 06:36 3,072,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-09-30 06:36 . 2008-09-30 06:36 52,720 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-09-30 06:35 . 2008-09-30 06:36 6,110 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-30 06:34 . 2008-09-30 06:34 <DIR> d-------- C:\WINDOWS\BricoPacks
2008-09-27 12:12 . 2008-09-27 12:12 <DIR> d-------- C:\Program Files\Common Files\Sandlot Shared
2008-09-27 12:12 . 2008-09-27 12:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sandlot Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-26 09:51 --------- d-----w C:\Documents and Settings\com\Application Data\DNA
2008-10-26 09:37 138,280 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-10-26 09:36 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-10-25 18:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-20 14:56 --------- d-----w C:\Documents and Settings\com\Application Data\Orbit
2008-10-20 04:15 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-19 14:38 30 ----a-w C:\Documents and Settings\com\jagex_runescape_preferences.dat
2008-10-07 18:45 --------- d-----w C:\Documents and Settings\com\Application Data\Hamachi
2008-10-07 18:38 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-10-04 05:20 --------- d-----w C:\Program Files\SpeedFan
2008-10-04 05:12 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-30 14:36 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-24 14:34 --------- d-----w C:\Documents and Settings\com\Application Data\GrabPro
2008-09-22 11:41 --------- d-----w C:\Program Files\Google
2008-09-20 03:18 --------- d-----w C:\Documents and Settings\com\Application Data\BitTorrent
2008-09-19 22:59 --------- d-----w C:\Program Files\Microsoft Student
2008-09-19 22:57 --------- d-----w C:\Program Files\Learning Essentials
2008-09-18 09:00 --------- d-----w C:\Program Files\DNA
2008-09-18 09:00 --------- d-----w C:\Program Files\BitTorrent
2008-09-13 05:39 --------- d-----w C:\Program Files\VentSrv
2008-09-13 05:39 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-13 05:33 --------- d-----w C:\Program Files\Ventrilo
2008-09-13 05:33 --------- d-----w C:\Documents and Settings\com\Application Data\Ventrilo
2008-09-07 14:45 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-09-04 13:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-01 07:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-01 07:12 --------- d-----w C:\Program Files\Windows Live
2008-09-01 07:12 --------- d-----w C:\Program Files\MSN Messenger
2008-09-01 07:12 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-30 03:36 --------- d-----w C:\Program Files\Web Publish
2008-08-29 12:20 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-28 20:45 --------- d-----w C:\Documents and Settings\com\Application Data\funkitron
2008-08-28 13:15 --------- d-----w C:\Program Files\DAEMON Tools
2008-08-28 13:14 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-08-27 20:32 --------- d-----w C:\Program Files\SLT
2008-08-26 17:54 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-08-26 17:54 --------- d-----w C:\Documents and Settings\com\Application Data\SystemRequirementsLab
2008-08-26 06:34 --------- d-----w C:\Documents and Settings\com\Application Data\Lavasoft
2008-08-26 04:46 --------- d-----w C:\Program Files\Java
2008-08-26 04:45 --------- d-----w C:\Program Files\Common Files\Java
2008-08-26 02:25 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-26 01:11 --------- d-----w C:\Program Files\DAP
.

------- Sigcheck -------

2006-10-25 22:20 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\user32.dll
2008-10-23 03:50 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\dllcache\user32.dll

2006-10-25 22:21 664576 64ce26db72810b30f7855ea51e1df836 C:\WINDOWS\system32\wininet.dll

2006-10-25 22:20 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\system32\drivers\tcpip.sys

2006-10-25 22:29 2016768 f196becedb849a135260b758fa546618 C:\WINDOWS\system32\ntkrnlpa.exe

2006-10-25 22:20 2137088 7000146d1b17fe998ba56f244eacc37d C:\WINDOWS\system32\ntoskrnl.exe

2006-10-25 22:19 1033216 42d32722b805d7df42d30487a0bcbd78 C:\WINDOWS\explorer.exe

2006-10-25 22:20 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\system32\spoolsv.exe

2006-10-25 22:20 295424 c29a5286e64d97385178452d5f307b98 C:\WINDOWS\system32\termsrv.dll
.
((((((((((((((((((((((((((((( snapshot@2008-10-25_ 2.37.42.20 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE
+ 2005-10-21 04:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE
- 2000-08-31 15:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe
+ 2000-08-31 16:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe
- 2000-08-31 15:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe
+ 2000-08-31 16:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe
- 2008-10-25 09:36:51 62,688 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-10-26 09:54:09 62,688 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-10-25 09:36:51 401,192 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-26 09:54:09 401,192 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-26 09:52:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_2d8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-09-18 289088]
"L07AXLRD_23637062"="C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2007 DVD\EDICT.EXE" [2006-06-10 351000]
"Google Update"="C:\Documents and Settings\com\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-22 133104]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]
"kamsoft"="C:\WINDOWS\system32\ckvo.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"msnsc"="C:\WINDOWS\system32\msnsc.exe" [2006-01-14 62054]
"ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-13 561213]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-03 16:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2007-08-24 10:01 159744 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2007-08-24 10:01 135168 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 2007-08-24 10:00 131072 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
--a------ 2007-09-27 16:05 202032 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-09-07 12:19 15872 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"D:\\Program Files\\Valve\\hlds.exe"=
"D:\\Program Files\\Xfire\\xfire.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-09-22 2368]
R3 HpqRemHid;HP Remote Control HID Device;C:\WINDOWS\system32\DRIVERS\HpqRemHid.sys [2007-07-11 7168]
R3 NETw5x32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit;C:\WINDOWS\system32\DRIVERS\NETw5x32.sys [2008-06-26 3630080]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WudfServiceGroup REG_SZ hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00
.
Contents of the 'Scheduled Tasks' folder

2008-10-26 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 16:39]

2008-10-25 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\com\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-22 03:11]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\com\Application Data\Mozilla\Firefox\Profiles\lq09wa15.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.com
FF -: plugin - C:\Documents and Settings\com\Local Settings\Application Data\Google\Update\1.2.131.25\npGoogleOneClick6.dll
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-26 01:55:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-26 1:56:12
ComboFix-quarantined-files.txt 2008-10-26 09:56:09
ComboFix2.txt 2008-10-25 18:41:51
ComboFix3.txt 2008-10-25 09:38:07

Pre-Run: 67,501,182,976 bytes free
Post-Run: 67,487,277,056 bytes free

220

[freakwizard]

Hiya!

Yeah I do have it, but im not sure if it works cause it has some scratches on the back since it's pretty old.

Did what you told and here's what you needed

ComboFix 08-10-24.02 - com 2008-10-26 1:54:10.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1581 [GMT -8:00]
Running from: C:\Documents and Settings\com\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

H:\autorun.inf
H:\xih9.cmd

.
((((((((((((((((((((((((( Files Created from 2008-09-26 to 2008-10-26 )))))))))))))))))))))))))))))))
.

2008-10-24 20:38 . 2008-10-24 20:38 <DIR> d-------- C:\Documents and Settings\Administrator
2008-10-23 03:52 . 2008-10-23 03:52 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-10-23 03:52 . 2008-10-23 03:52 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-10-23 03:50 . 2008-10-23 03:50 577,024 --a------ C:\WINDOWS\system32\dllcache\user32.dll
2008-10-23 03:49 . 2008-10-23 03:49 <DIR> d-------- C:\WINDOWS\ERUNT
2008-10-23 02:56 . 2008-10-23 03:55 <DIR> d-------- C:\SDFix
2008-10-20 07:24 . 2008-10-26 01:49 <DIR> d-------- C:\Documents and Settings\com\Application Data\Xfire
2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\_OTMoveIt
2008-10-19 20:19 . 2008-10-19 20:19 <DIR> d-------- C:\Program Files\ERUNT
2008-10-19 07:28 . 2008-10-19 07:28 <DIR> d-------- C:\rsit
2008-10-19 07:09 . 2008-10-19 07:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-18 09:17 . 2008-10-18 09:17 <DIR> d-------- C:\Program Files\Alwil Software
2008-10-18 08:56 . 2008-10-18 08:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-10-16 05:01 . 2008-10-16 05:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\2DBoy
2008-10-08 16:48 . 2008-10-08 16:48 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-10-07 10:38 . 2008-10-07 10:38 <DIR> d-------- C:\Program Files\Hamachi
2008-10-07 08:15 . 2008-10-07 08:15 <DIR> d-------- C:\Program Files\Opera
2008-10-07 05:43 . 2008-10-07 05:43 <DIR> d-------- C:\Program Files\KeepV Converter
2008-10-06 04:40 . 2008-10-06 04:40 <DIR> d-------- C:\Program Files\Orbitdownloader
2008-10-03 22:26 . 2008-10-03 22:43 <DIR> d-------- C:\Program Files\MSECache
2008-10-03 21:13 . 2006-10-04 06:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-10-03 21:13 . 2006-10-04 06:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-10-03 21:13 . 2004-08-03 16:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-10-03 21:13 . 2006-10-04 06:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-10-03 21:12 . 2008-10-03 21:12 <DIR> d-------- C:\189016a8cff9dbed44
2008-09-30 06:36 . 2008-09-30 06:36 3,072,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2008-09-30 06:36 . 2008-09-30 06:36 52,720 --a------ C:\WINDOWS\BricoPackUninst.cmd
2008-09-30 06:35 . 2008-09-30 06:36 6,110 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-30 06:34 . 2008-09-30 06:34 <DIR> d-------- C:\WINDOWS\BricoPacks
2008-09-27 12:12 . 2008-09-27 12:12 <DIR> d-------- C:\Program Files\Common Files\Sandlot Shared
2008-09-27 12:12 . 2008-09-27 12:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sandlot Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-26 09:51 --------- d-----w C:\Documents and Settings\com\Application Data\DNA
2008-10-26 09:37 138,280 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-10-26 09:36 111,928 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-10-25 18:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-20 14:56 --------- d-----w C:\Documents and Settings\com\Application Data\Orbit
2008-10-20 04:15 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-19 14:38 30 ----a-w C:\Documents and Settings\com\jagex_runescape_preferences.dat
2008-10-07 18:45 --------- d-----w C:\Documents and Settings\com\Application Data\Hamachi
2008-10-07 18:38 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-10-04 05:20 --------- d-----w C:\Program Files\SpeedFan
2008-10-04 05:12 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-30 14:36 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-24 14:34 --------- d-----w C:\Documents and Settings\com\Application Data\GrabPro
2008-09-22 11:41 --------- d-----w C:\Program Files\Google
2008-09-20 03:18 --------- d-----w C:\Documents and Settings\com\Application Data\BitTorrent
2008-09-19 22:59 --------- d-----w C:\Program Files\Microsoft Student
2008-09-19 22:57 --------- d-----w C:\Program Files\Learning Essentials
2008-09-18 09:00 --------- d-----w C:\Program Files\DNA
2008-09-18 09:00 --------- d-----w C:\Program Files\BitTorrent
2008-09-13 05:39 --------- d-----w C:\Program Files\VentSrv
2008-09-13 05:39 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-13 05:33 --------- d-----w C:\Program Files\Ventrilo
2008-09-13 05:33 --------- d-----w C:\Documents and Settings\com\Application Data\Ventrilo
2008-09-07 14:45 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-09-04 13:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-01 07:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-01 07:12 --------- d-----w C:\Program Files\Windows Live
2008-09-01 07:12 --------- d-----w C:\Program Files\MSN Messenger
2008-09-01 07:12 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-30 03:36 --------- d-----w C:\Program Files\Web Publish
2008-08-29 12:20 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-28 20:45 --------- d-----w C:\Documents and Settings\com\Application Data\funkitron
2008-08-28 13:15 --------- d-----w C:\Program Files\DAEMON Tools
2008-08-28 13:14 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-08-27 20:32 --------- d-----w C:\Program Files\SLT
2008-08-26 17:54 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-08-26 17:54 --------- d-----w C:\Documents and Settings\com\Application Data\SystemRequirementsLab
2008-08-26 06:34 --------- d-----w C:\Documents and Settings\com\Application Data\Lavasoft
2008-08-26 04:46 --------- d-----w C:\Program Files\Java
2008-08-26 04:45 --------- d-----w C:\Program Files\Common Files\Java
2008-08-26 02:25 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-26 01:11 --------- d-----w C:\Program Files\DAP
.

------- Sigcheck -------

2006-10-25 22:20 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\user32.dll
2008-10-23 03:50 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\dllcache\user32.dll

2006-10-25 22:21 664576 64ce26db72810b30f7855ea51e1df836 C:\WINDOWS\system32\wininet.dll

2006-10-25 22:20 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\system32\drivers\tcpip.sys

2006-10-25 22:29 2016768 f196becedb849a135260b758fa546618 C:\WINDOWS\system32\ntkrnlpa.exe

2006-10-25 22:20 2137088 7000146d1b17fe998ba56f244eacc37d C:\WINDOWS\system32\ntoskrnl.exe

2006-10-25 22:19 1033216 42d32722b805d7df42d30487a0bcbd78 C:\WINDOWS\explorer.exe

2006-10-25 22:20 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\system32\spoolsv.exe

2006-10-25 22:20 295424 c29a5286e64d97385178452d5f307b98 C:\WINDOWS\system32\termsrv.dll
.
((((((((((((((((((((((((((((( snapshot@2008-10-25_ 2.37.42.20 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE
+ 2005-10-21 04:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE
- 2000-08-31 15:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe
+ 2000-08-31 16:00:00 28,672 ----a-w C:\WINDOWS\NIRCMD.exe
- 2000-08-31 15:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe
+ 2000-08-31 16:00:00 161,792 ----a-w C:\WINDOWS\SWREG.exe
- 2008-10-25 09:36:51 62,688 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-10-26 09:54:09 62,688 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-10-25 09:36:51 401,192 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-26 09:54:09 401,192 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-26 09:52:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_2d8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-09-18 289088]
"L07AXLRD_23637062"="C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2007 DVD\EDICT.EXE" [2006-06-10 351000]
"Google Update"="C:\Documents and Settings\com\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-22 133104]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]
"kamsoft"="C:\WINDOWS\system32\ckvo.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"msnsc"="C:\WINDOWS\system32\msnsc.exe" [2006-01-14 62054]
"ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-13 561213]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-03 16:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2007-08-24 10:01 159744 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2007-08-24 10:01 135168 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 2007-08-24 10:00 131072 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
--a------ 2007-09-27 16:05 202032 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2006-09-07 12:19 15872 C:\Program Files\Unlocker\UnlockerAssistant.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"D:\\Program Files\\Valve\\hlds.exe"=
"D:\\Program Files\\Xfire\\xfire.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-09-22 2368]
R3 HpqRemHid;HP Remote Control HID Device;C:\WINDOWS\system32\DRIVERS\HpqRemHid.sys [2007-07-11 7168]
R3 NETw5x32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit;C:\WINDOWS\system32\DRIVERS\NETw5x32.sys [2008-06-26 3630080]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WudfServiceGroup REG_SZ hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00
.
Contents of the 'Scheduled Tasks' folder

2008-10-26 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 16:39]

2008-10-25 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\com\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-22 03:11]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\com\Application Data\Mozilla\Firefox\Profiles\lq09wa15.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.com
FF -: plugin - C:\Documents and Settings\com\Local Settings\Application Data\Google\Update\1.2.131.25\npGoogleOneClick6.dll
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-26 01:55:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-26 1:56:12
ComboFix-quarantined-files.txt 2008-10-26 09:56:09
ComboFix2.txt 2008-10-25 18:41:51
ComboFix3.txt 2008-10-25 09:38:07

Pre-Run: 67,501,182,976 bytes free
Post-Run: 67,487,277,056 bytes free

220

[Egwene]

Hello,

No need windows CD now

Please do an online scan with Kaspersky WebScanner

Make sure you are using Internet Explorer for this. Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Regards,
Egwene.

[Egwene]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.