win32/adware.virtumonde help [CLOSED]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

win32/adware.virtumonde help [CLOSED]

Options

nelinski250 View Member Profile	Oct 7 2008, 04:08 AM Post #1
New Member Posts: 8 OS: xp	Please, help me with this my hijack log is Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:06:18, on 07.10.2008 г. Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\System32\svchost.exe C:\DOCUME~1\NelkA\LOCALS~1\Temp\sysfnx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.data.bg/ O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [b87b54b4] rundll32.exe "C:\WINDOWS\system32\djdheawe.dll",b O4 - HKLM\..\Run: [BMbb486728] Rundll32.exe "C:\WINDOWS\system32\vxfkurkn.dll",s O4 - HKLM\..\Run: [System] C:\kernelcheck.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [System] C:\kernelcheck.exe O4 - HKLM\..\Policies\Explorer\Run: [System Sound] C:\DOCUME~1\NelkA\LOCALS~1\Temp\\sysfnx.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) - https://ebb.ubb.bg/CAPICOM/capicom.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: WindowsMgr (winvnc) - Unknown owner - C:\WINDOWS\SVCHOST.EXE (file missing) -- End of file - 6007 bytes

Egwene View Member Profile	Oct 7 2008, 04:59 AM Post #2
Trusted Helper Posts: 2,141 From: France OS: XP/Vista �dition basique familiale	Hello nelinski250, Welcome to the site! My name's Egwene and I'll be helping clean up your computer. Before we proceed to clean your computer from malware, let's go over some points that will help both me and you, and prevent causing damage to your computer: To make sure that you receive an email when I reply to this topic, please click here and check that this topic is listed under Malware Removal - HijackThis� Logs Go Here. Please don't be afraid to ask questions! No question is considered dumb here. It's better to be safe than sorry! When posting logs, please ensure Wordwrap is turned off in Notepad (to check, open Notepad click on Format \| Uncheck Word Wrap) Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know. NEVER fix anything in HijackThis or other programs on your own! This can be very dangerous and cause harm to your system. If you see a certain entry or program you're unsure about, please don't hesitate to ask! Make sure you reply to this thread using the Add Reply button: * Let's begin the removal 1) Run MBAM : Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. 2) Run LopSD option 1 : Disable resident protections (Antivirus...); you'll re-enable them after the scan Download Lop S&D < here Double-click Lop S&D.exe Choose the language, then choose Option 1** (Search) Wait till the end of the scan Post the log which is created: (%SystemDrive%\lopR.txt) Regards, Egwene.

nelinski250 View Member Profile	Oct 7 2008, 05:31 AM Post #3
New Member Posts: 8 OS: xp	Thank you very much for your help. I am sorry for my english but I am from Bulgaria...Now I am running Malwarebytes but after that I don't know how to disable the protection - I have only NOD32 and Sygate Personal Firewall Pro so I can continue with Lop S&D. Malwarebytes' Anti-Malware 1.27 Database version: 1127 Windows 5.1.2600 Service Pack 2 07.10.2008 г. 14:22:19 mbam-log-2008-10-07 (14-22-19).txt Scan type: Quick Scan Objects scanned: 42872 Time elapsed: 6 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 3 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\urqOHATj.dll (Trojan.Vundo.H) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1cf662bf-4afd-4778-8306-1f0eb8284ebb} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqohatj (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1cf662bf-4afd-4778-8306-1f0eb8284ebb} (Trojan.Vundo.H) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1cf662bf-4afd-4778-8306-1f0eb8284ebb} (Trojan.Vundo.H) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\urqOHATj.dll (Trojan.Vundo.H) -> Delete on reboot.

nelinski250 View Member Profile	Oct 7 2008, 05:46 AM Post #4
New Member Posts: 8 OS: xp	This is the log from Lop S&D: --------------------\\ Lop S&D 4.2.4-5 XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2 X86-based PC ( Uniprocessor Free : Intel® Pentium® M processor 1.73GHz ) BIOS : Default System BIOS USER : NelkA ( Administrator ) BOOT : Normal boot Antivirus : Eset NOD32 antivirus system 2.51 2.51 (Not Activated) Firewall : Sygate Personal Firewall Pro 4.6 (Activated) C:\ (Local Disk) - NTFS - Total : 26 Go Free : 5 Go D:\ (Local Disk) - NTFS - Total : 47 Go Free : 11 Go E:\ (CD or DVD) F:\ (USB) G:\ (USB) H:\ (CD or DVD) "C:\Lop SD" ( MAJ : 02-10-2008\|23:42 ) Option : [1] ( 07.10.2008 Ј.\|14:42 ) --------------------\\ Listing folders in APPLIC~1 [16.12.2007\|Ј.] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Intel [17.12.2007\|Ј.] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Microsoft [10.10.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> ACD Systems [03.10.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe [02.10.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer [08.05.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> CyberLink [24.07.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Diskeeper Corporation [19.08.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Installations [03.10.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Intel [07.10.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes [07.10.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft [02.01.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft Help [19.08.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PC Suite [02.10.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Real [27.10.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Skype [07.10.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TEMP [09.12.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Trymedia [06.10.2007\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage [29.04.2008\|Ј.] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller [02.10.2007\|Ј.] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft [04.10.2008\|Ј.] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft [07.10.2008\|Ј.] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Webroot [10.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> ACD Systems [08.11.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Adobe [13.11.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> AdobeUM [03.10.2008\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Ahead [08.05.2008\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> CyberLink [02.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Help [29.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> ICAClient [03.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> ICQLite [02.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Identities [03.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Intel [12.12.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Macromedia [07.10.2008\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Malwarebytes [13.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Media Player Classic [16.12.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Microsoft [17.12.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> MSN6 [19.08.2008\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Nokia [02.09.2008\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> PC Suite [18.12.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> PC Tools [27.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Real [06.10.2008\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> Skype [02.10.2007\|Ј.] C:\DOCUME~1\NelkA\APPLIC~1\<DIR> URSoft [02.10.2007\|Ј.] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft --------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks [07.10.2008 Ј. 14:25][--ah-----] C:\WINDOWS\tasks\SA.DAT [23.08.2001 Ј. 15:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini --------------------\\ Listing Folders in C:\Program Files [10.10.2007\|Ј.] C:\Program Files\<DIR> ACD Systems [16.12.2007\|Ј.] C:\Program Files\<DIR> Adobe [29.10.2007\|Ј.] C:\Program Files\<DIR> Alcohol Soft [02.10.2007\|Ј.] C:\Program Files\<DIR> ATI Technologies [04.05.2008\|Ј.] C:\Program Files\<DIR> Atlant Software [24.01.2008\|Ј.] C:\Program Files\<DIR> BFG [18.12.2007\|Ј.] C:\Program Files\<DIR> BitSpirit [21.02.2008\|Ј.] C:\Program Files\<DIR> BookReader [03.10.2007\|Ј.] C:\Program Files\<DIR> Change Folder Icon [29.10.2007\|Ј.] C:\Program Files\<DIR> Citrix [07.10.2008\|Ј.] C:\Program Files\<DIR> Common Files [02.10.2007\|Ј.] C:\Program Files\<DIR> ComPlus Applications [02.10.2007\|Ј.] C:\Program Files\<DIR> CONEXANT [02.10.2007\|Ј.] C:\Program Files\<DIR> Crystal Player [08.05.2008\|Ј.] C:\Program Files\<DIR> CyberLink [03.10.2007\|Ј.] C:\Program Files\<DIR> DAP [02.10.2007\|Ј.] C:\Program Files\<DIR> Datecs [19.08.2008\|Ј.] C:\Program Files\<DIR> DIFX [24.07.2008\|Ј.] C:\Program Files\<DIR> Diskeeper Corporation [10.01.2008\|Ј.] C:\Program Files\<DIR> Duke Nukem - Manhattan Project [04.10.2008\|Ј.] C:\Program Files\<DIR> ESET [21.09.2008\|Ј.] C:\Program Files\<DIR> Favorite-Games [03.10.2007\|Ј.] C:\Program Files\<DIR> File Scavenger 3.0 [03.10.2007\|Ј.] C:\Program Files\<DIR> Folder Marker [29.01.2008\|Ј.] C:\Program Files\<DIR> Hasbro [07.10.2008\|Ј.] C:\Program Files\<DIR> HijackThis [10.10.2007\|Ј.] C:\Program Files\<DIR> IconChanger [18.12.2007\|Ј.] C:\Program Files\<DIR> IconViewer350 [24.10.2007\|Ј.] C:\Program Files\<DIR> ICQLite [19.08.2008\|Ј.] C:\Program Files\<DIR> InstallShield Installation Information [03.10.2007\|Ј.] C:\Program Files\<DIR> Intel [09.04.2008\|Ј.] C:\Program Files\<DIR> Internet Explorer [02.10.2007\|Ј.] C:\Program Files\<DIR> K-Lite Codec Pack [02.10.2007\|Ј.] C:\Program Files\<DIR> LanCL [07.10.2008\|Ј.] C:\Program Files\<DIR> Malwarebytes' Anti-Malware [04.10.2007\|Ј.] C:\Program Files\<DIR> Messenger [02.01.2008\|Ј.] C:\Program Files\<DIR> Microsoft ActiveSync [02.10.2007\|Ј.] C:\Program Files\<DIR> microsoft frontpage [02.01.2008\|Ј.] C:\Program Files\<DIR> Microsoft Office [29.04.2008\|Ј.] C:\Program Files\<DIR> Microsoft SQL Server Compact Edition [17.01.2008\|Ј.] C:\Program Files\<DIR> MOP [02.10.2007\|Ј.] C:\Program Files\<DIR> Movie Maker [02.10.2007\|Ј.] C:\Program Files\<DIR> MSN [02.10.2007\|Ј.] C:\Program Files\<DIR> MSN Gaming Zone [03.10.2008\|Ј.] C:\Program Files\<DIR> Nero [02.10.2007\|Ј.] C:\Program Files\<DIR> NetMeeting [03.10.2007\|Ј.] C:\Program Files\<DIR> NGWave 3 [19.08.2008\|Ј.] C:\Program Files\<DIR> Nokia [02.10.2007\|Ј.] C:\Program Files\<DIR> Online Services [04.10.2007\|Ј.] C:\Program Files\<DIR> Outlook Express [19.08.2008\|Ј.] C:\Program Files\<DIR> PC Connectivity Solution [03.10.2007\|Ј.] C:\Program Files\<DIR> Realtek [03.10.2007\|Ј.] C:\Program Files\<DIR> Rockstar Games [03.10.2007\|Ј.] C:\Program Files\<DIR> SA Dictionary 2005 T2 [27.01.2008\|Ј.] C:\Program Files\<DIR> Shockwave.com [27.10.2007\|Ј.] C:\Program Files\<DIR> Skype [01.02.2008\|Ј.] C:\Program Files\<DIR> SmartMovie Converter [18.12.2007\|Ј.] C:\Program Files\<DIR> Spyware Doctor [02.10.2007\|Ј.] C:\Program Files\<DIR> Sygate [03.10.2007\|Ј.] C:\Program Files\<DIR> Synaptics [02.10.2007\|Ј.] C:\Program Files\<DIR> Uninstall Information [05.10.2007\|Ј.] C:\Program Files\<DIR> Unlocker [29.09.2008\|Ј.] C:\Program Files\<DIR> USBScan [03.04.2008\|Ј.] C:\Program Files\<DIR> Winamp [29.04.2008\|Ј.] C:\Program Files\<DIR> Windows Live [06.10.2007\|Ј.] C:\Program Files\<DIR> Windows Media Connect 2 [06.10.2007\|Ј.] C:\Program Files\<DIR> Windows Media Player [02.10.2007\|Ј.] C:\Program Files\<DIR> Windows NT [03.10.2007\|Ј.] C:\Program Files\<DIR> WindowsUpdate [02.10.2007\|Ј.] C:\Program Files\<DIR> WinRAR [20.10.2007\|Ј.] C:\Program Files\<DIR> WPlay Pro [02.10.2007\|Ј.] C:\Program Files\<DIR> xerox [13.11.2007\|Ј.] C:\Program Files\<DIR> Your Uninstaller 2006 --------------------\\ Listing Folders in C:\Program Files\Common Files [10.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> ACD Systems [03.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> Adobe [03.10.2008\|Ј.] C:\Program Files\Common Files\<DIR> Ahead [08.05.2008\|Ј.] C:\Program Files\Common Files\<DIR> CyberLink [02.01.2008\|Ј.] C:\Program Files\Common Files\<DIR> DESIGNER [10.01.2008\|Ј.] C:\Program Files\Common Files\<DIR> InstallShield [08.05.2008\|Ј.] C:\Program Files\Common Files\<DIR> Microsoft Shared [02.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> MSSoap [19.08.2008\|Ј.] C:\Program Files\Common Files\<DIR> Nokia [02.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> ODBC [19.08.2008\|Ј.] C:\Program Files\Common Files\<DIR> PCSuite [02.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> Services [27.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> Skype [02.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> SpeechEngines [02.01.2008\|Ј.] C:\Program Files\Common Files\<DIR> System [29.04.2008\|Ј.] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller [02.10.2007\|Ј.] C:\Program Files\Common Files\<DIR> Wise Installation Wizard --------------------\\ Process ( 38 Processes ) iexplore.exe ~ [PID:1140] iexplore.exe ~ [PID:3572] --------------------\\ Searching with S_Lop No Lop folder found ! --------------------\\ Searching for Lop Files - Folders No Lop folder found ! --------------------\\ Searching within the Registry ..... OK ! --------------------\\ Checking the Hosts file Hosts file CLEAN --------------------\\ Searching for hidden files with Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-07 14:42:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 4 --------------------\\ Searching for other infections --------------------\\ Cracks & Keygens .. C:\DOCUME~1\NelkA\Recent\Nero Burning Rom 7.0.8.2 KeyGen.lnk [F:315][D:6]-> C:\DOCUME~1\NelkA\LOCALS~1\Temp [F:120][D:0]-> C:\DOCUME~1\NelkA\Cookies [F:612][D:20]-> C:\DOCUME~1\NelkA\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - 07.10.2008 Ј.\|14:43 - Option : [1] --------------------\\ Scan completed at 14:43:53

Egwene View Member Profile	Oct 7 2008, 03:30 PM Post #5
Trusted Helper Posts: 2,141 From: France OS: XP/Vista �dition basique familiale	Hello nelinski250, Let's go on Download random's system information tool (RSIT) by random/random from here and save it to your desktop. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized) N.B : Please check if you have posted me all the content of the log. If not, please post me what is missing in a other reply Regards, Egwene.

nelinski250 View Member Profile	Oct 8 2008, 01:07 AM Post #6
New Member Posts: 8 OS: xp	Hello again, I don't have any probles now only when I boot my pc there is a message ssiefr.exe not found but after that everything is ok. But I continue with your advices so..: Logfile of random's system information tool 1.04 (written by random/random) Run by NelkA at 2008-10-08 10:03:11 Microsoft Windows XP Professional Service Pack 2 System drive C: has 6 GB (21%) free of 27 GB Total RAM: 1023 MB (57% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:03:21, on 08.10.2008 г. Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\DAP\DAP.EXE C:\Documents and Settings\NelkA\Desktop\RSIT.exe C:\Program Files\trend micro\NelkA.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.data.bg/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) - https://ebb.ubb.bg/CAPICOM/capicom.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: WindowsMgr (winvnc) - Unknown owner - C:\WINDOWS\SVCHOST.EXE (file missing) -- End of file - 6586 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0000CC75-ACF3-4cac-A0A9-DD3868E06852}] DAPHelper Class - C:\Program Files\DAP\DAPBHO.dll [2007-10-02 98304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2007-10-18 1373480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SmcService"=C:\PROGRA~1\Sygate\SPF\smc.exe [2005-06-06 2614496] "IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2005-05-31 401408] "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-12-22 98394] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-12-22 688218] "HControl"=C:\WINDOWS\ATK0100\HControl.exe [2005-07-28 102400] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-09-06 14850560] "BluetoothAuthenticationAgent"=C:\WINDOWS\system32\bthprops.cpl [2004-08-04 110592] "nod32kui"=C:\Program Files\Eset\nod32kui.exe [2008-10-04 921600] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "BITS"=3 C:\Documents and Settings\All Users\Start Menu\Programs\Startup Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe FlexType 2K.lnk - C:\Program Files\Datecs\FlexType 2K\FType2K.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2005-08-30 46080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [2005-05-31 110592] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier] WRLogonNTF.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "NoDrives"= "NoDriveAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\BitSpirit\BitSpirit.exe"="C:\Program Files\BitSpirit\BitSpirit.exe::Enabled:The powerful and easy-to-use BitTorrent Client" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe::Enabled:Windows Messenger" "C:\Program Files\ICQLite\ICQLite.exe"="C:\Program Files\ICQLite\ICQLite.exe::Enabled:ICQ Lite" "D:\GAMES\Counter-Strike Source\hl2.exe"="D:\GAMES\Counter-Strike Source\hl2.exe::Enabled:hl2" "C:\Program Files\Duke Nukem - Manhattan Project\prism3d.exe"="C:\Program Files\Duke Nukem - Manhattan Project\prism3d.exe::Enabled:prism3d" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe::Enabled:CyberLink PowerDVD 8.0" "C:\Program Files\DAP\DAP.exe"="C:\Program Files\DAP\DAP.exe::Enabled:Download Accelerator Plus" "D:\GAMES\Taxi3 eXtreme Rush\Extreme Rush.exe"="D:\GAMES\Taxi3 eXtreme Rush\Extreme Rush.exe::Enabled:eXtreme Rush" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe::Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe::Enabled:CyberLink PowerDVD 8.0" ======List of files/folders created in the last 1 months====== 2008-10-08 10:03:11 ----D---- C:\rsit 2008-10-08 10:03:11 ----D---- C:\Program Files\trend micro 2008-10-07 16:45:30 ----A---- C:\WINDOWS\system32\NeroCheck.exe 2008-10-07 16:40:25 ----D---- C:\Program Files\Ahead 2008-10-07 16:03:01 ----SHD---- C:\RECYCLER 2008-10-07 14:41:33 ----D---- C:\Lop SD 2008-10-07 14:10:07 ----D---- C:\Documents and Settings\NelkA\Application Data\Malwarebytes 2008-10-07 14:09:51 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-07 13:35:20 ----A---- C:\Boot.bak 2008-10-07 13:35:09 ----D---- C:\cmdcons 2008-10-07 13:34:00 ----D---- C:\WINDOWS\erdnt 2008-10-07 13:31:54 ----D---- C:\QooBox 2008-10-07 13:31:36 ----A---- C:\WINDOWS\zip.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\VFIND.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\SWREG.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\sed.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\grep.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\fdsv.exe 2008-10-07 13:31:35 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-10-07 13:31:35 ----A---- C:\WINDOWS\SWSC.exe 2008-10-07 13:14:18 ----A---- C:\WINDOWS\nircmd.exe 2008-10-07 13:03:27 ----D---- C:\Program Files\HijackThis 2008-10-07 12:09:54 ----D---- C:\VundoFix Backups 2008-10-07 10:15:04 ----D---- C:\WINDOWS\system32\NtmsData 2008-10-07 09:34:20 ----A---- C:\WINDOWS\WRUninstall.dll 2008-10-07 09:34:20 ----A---- C:\WINDOWS\ssleay32.dll 2008-10-07 09:34:20 ----A---- C:\WINDOWS\libeay32.dll 2008-10-06 21:16:29 ----ASH---- C:\WINDOWS\system32\ewaehdjd.ini 2008-10-06 20:37:14 ----ASH---- C:\WINDOWS\system32\ryxcbjmx.ini 2008-10-06 19:26:10 ----ASH---- C:\WINDOWS\system32\rmeaykkj.ini 2008-10-05 20:00:06 ----ASH---- C:\WINDOWS\system32\sisesfoe.ini 2008-10-04 22:07:26 ----A---- C:\WINDOWS\system32\imon.dll 2008-10-04 19:25:47 ----ASH---- C:\WINDOWS\system32\jkdejcig.ini 2008-10-04 16:23:38 ----ASH---- C:\WINDOWS\system32\qhqfwuot.ini 2008-10-04 16:23:07 ----A---- C:\WINDOWS\system32\b35890ca-.txt 2008-09-17 16:50:00 ----D---- C:\Program Files\Favorite-Games ======List of files/folders modified in the last 1 months====== 2008-10-08 10:03:11 ----RD---- C:\Program Files 2008-10-08 10:02:39 ----D---- C:\WINDOWS\Prefetch 2008-10-08 09:47:37 ----D---- C:\WINDOWS\Temp 2008-10-08 09:46:22 ----D---- C:\WINDOWS\system32\Lang 2008-10-07 22:04:09 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-10-07 21:49:08 ----D---- C:\Documents and Settings\NelkA\Application Data\Skype 2008-10-07 16:45:46 ----D---- C:\WINDOWS\system32\drivers 2008-10-07 16:45:30 ----D---- C:\WINDOWS\system32 2008-10-07 16:45:30 ----D---- C:\Program Files\Common Files\Ahead 2008-10-07 16:44:26 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-07 16:35:43 ----SHD---- C:\WINDOWS\Installer 2008-10-07 16:35:42 ----D---- C:\Program Files\BookReader 2008-10-07 16:34:12 ----D---- C:\WINDOWS 2008-10-07 15:07:37 ----D---- C:\WINDOWS\system32\CatRoot2 2008-10-07 13:46:06 ----A---- C:\WINDOWS\system.ini 2008-10-07 13:42:29 ----D---- C:\WINDOWS\system32\config 2008-10-07 13:38:11 ----D---- C:\WINDOWS\AppPatch 2008-10-07 13:38:11 ----D---- C:\Program Files\Common Files 2008-10-07 13:36:19 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-10-07 13:35:20 ----RASH---- C:\boot.ini 2008-10-07 10:28:18 ----D---- C:\Documents and Settings 2008-10-07 10:21:37 ----D---- C:\WINDOWS\system32\Restore 2008-10-07 10:19:59 ----D---- C:\WINDOWS\repair 2008-10-07 10:19:38 ----D---- C:\WINDOWS\Registration 2008-10-07 10:15:02 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-10-05 21:01:46 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-10-05 20:23:33 ----SHD---- C:\System Volume Information 2008-10-04 22:55:56 ----D---- C:\Program Files\ESET 2008-10-03 18:11:48 ----D---- C:\Documents and Settings\NelkA\Application Data\Ahead 2008-10-03 18:11:44 ----A---- C:\WINDOWS\NeroDigital.ini 2008-10-03 17:41:45 ----HD---- C:\WINDOWS\inf 2008-09-21 16:19:04 ----D---- C:\WINDOWS\system32\wbem 2008-09-21 16:18:38 ----D---- C:\WINDOWS\security ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096] R1 wpsdrvnt;wpsdrvnt; \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys [] R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-10-03 17801] R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys [] R2 irda;IrDA Protocol; C:\WINDOWS\System32\DRIVERS\irda.sys [2004-08-03 87424] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-01-17 13059] R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2005-05-03 11354] R2 wg3n;SyGate for NT, wg3n; C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys [2005-06-06 14448] R2 wg4n;SyGate for NT, wg4n; C:\WINDOWS\SYSTEM32\Drivers\wg4n.sys [2005-06-06 14448] R2 wg5n;SyGate for NT, wg5n; C:\WINDOWS\SYSTEM32\Drivers\wg5n.sys [2005-06-06 14448] R2 wg6n;SyGate for NT, wg6n; C:\WINDOWS\SYSTEM32\Drivers\wg6n.sys [2005-06-06 14448] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800] R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2005-08-30 1333760] R3 BthEnum;Bluetooth Request Block Driver; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-03 17024] R3 BTHMODEM;Bluetooth Modem Communications Driver; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2004-08-03 38016] R3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992] R3 BTHUSB;Bluetooth Radio USB Driver; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-03 18944] R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-23 9600] R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2005-01-17 1036928] R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2005-01-17 163328] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-09-08 3959808] R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\System32\DRIVERS\irsir.sys [2001-08-17 18688] R3 IWCA;Intel Wireless Connection Agent Miniport for Win XP; C:\WINDOWS\system32\DRIVERS\iwca.sys [2004-08-12 234496] R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-23 12160] R3 MTsensor;ATK0100 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ATKACPI.sys [2005-02-17 5632] R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824] R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2004-08-03 59648] R3 SynMini;USB2.0 1.3M Web Cam; C:\WINDOWS\System32\Drivers\SynMini.sys [2005-08-26 720438] R3 SynScan;USB2.0 1.3M Web Cam Still Image; C:\WINDOWS\System32\Drivers\SynScan.sys [2005-09-09 8246] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-12-22 186240] R3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2004-12-21 34816] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480] R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2005-04-30 3281408] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-01-17 702592] R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\yukonwxp.sys [2004-06-02 142464] S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2004-08-03 14848] S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2004-10-04 62799] S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2004-08-03 274304] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920] S3 IKFileSec;File Security Driver; C:\WINDOWS\system32\drivers\ikfilesec.sys [2007-10-18 41288] S3 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2007-12-17 56832] S3 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2007-12-17 74240] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632] S3 sdbus;sdbus; C:\WINDOWS\System32\DRIVERS\sdbus.sys [2004-08-03 67584] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:\WINDOWS\system32\drivers\Toshidpt.sys [2002-10-16 2851] S3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\system32\DRIVERS\tosporte.sys [2005-03-30 47230] S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2005-07-04 98176] S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2004-07-08 36531] S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys [2005-06-27 53504] S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:\WINDOWS\system32\DRIVERS\tosrfnds.sys [2005-01-06 18612] S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:\WINDOWS\system32\drivers\TosRfSnd.sys [2005-04-06 50048] S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264] S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 vsdatant;vsdatant; C:\WINDOWS\system32\drivers\vsdatant.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2005-08-30 376832] R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336] R2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2007-10-16 1094936] R2 EvtEng;EvtEng; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2005-06-03 86016] R2 Irmon;Infrared Monitor; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336] R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2008-10-04 507904] R2 OwnershipProtocol;OwnershipProtocol; C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe [2005-05-31 98304] R2 RegSrvc;RegSrvc; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2005-06-03 139264] R2 S24EventMonitor;Spectrum24 Event Monitor; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2005-06-03 372809] R2 SmcService;Sygate Personal Firewall Pro; C:\Program Files\Sygate\SPF\smc.exe [2005-06-06 2614496] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336] S2 winvnc;WindowsMgr; C:\WINDOWS\SVCHOST.EXE -service [] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\svcntaux.exe [2007-11-02 311112] S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\swdsvc.exe [2007-11-02 1418056] S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-05-30 572416] S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328] S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] -----------------EOF----------------- info.txt logfile of random's system information tool 1.04 2008-10-08 10:03:23 ======Uninstall list====== -->MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F} -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D00360DC-9634-44CC-AF88-924A12406E81}\SETUP.EXE" -l0x9 anything -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf ACDSee Pro 2-->MsiExec.exe /I{4AAC95F4-A30E-4EE5-A086-6F79581D0D70} Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 7.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000} Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Control Panel-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe" ATI Display Driver-->rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean ATK0100 ACPI UTILITY-->C:\WINDOWS\ATK0100\XPunin.exe BitSpirit v3.1.0.077 Stable Release-->"C:\Program Files\BitSpirit\unins000.exe" Citrix Presentation Server Client-->MsiExec.exe /I{B2AE44CB-2AAB-4C08-A54B-D264BD604DA8} Crystal Player Professional 1.97-->C:\Program Files\Crystal Player\Uninstall.exe CyberLink PowerDVD 8-->"C:\Program Files\InstallShield Installation Information\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\Setup.exe" /z-uninstall Diskeeper 2008 Pro Premier-->MsiExec.exe /X{67A48ED5-0B6A-470A-995C-B8F1942E8AB9} Download Accelerator Plus -->C:\PROGRA~1\DAP\UNWISE.EXE C:\PROGRA~1\DAP\INSTALL.LOG Duke Nukem - Manhattan Project-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{8B9336DB-8D04-4325-BAFC-C7141D8E6CA1} Favorite-Games 5.10-2-->"C:\Program Files\Favorite-Games\unins000.exe" File Scavenger 3.0-->"C:\Program Files\File Scavenger 3.0\unins000.exe" FlexType 2K-->C:\PROGRA~1\Datecs\FLEXTY~1\UNWISE.EXE C:\PROGRA~1\Datecs\FLEXTY~1\INSTALL.LOG Folder Marker Pro v 2.0-->"C:\Program Files\Folder Marker\unins000.exe" Fraps (remove only)-->"C:\Fraps\uninstall.exe" GTA San Andreas-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}\setup.exe" -l0x9 -removeonly HDAUDIO SoftV92 Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10431966\HXFSETUP.EXE -U -IHDAUDIO\FUNC_02&VEN_14F1&DEV_2BFA&SUBSYS_10431966 High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe" HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe" Hotfix for Windows XP (KB935448)-->"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe" Icon Viewer 3.5-->"C:\Program Files\IconViewer350\unins000.exe" ICQ 5.1-->C:\Program Files\ICQLite\ICQLiteUninstall.EXE Intel® PROSet/Wireless Software-->C:\WINDOWS\Installer\iProInst.exe K-Lite Mega Codec Pack 1.67-->"C:\Program Files\K-Lite Codec Pack\unins000.exe" LAN Client 10012-->C:\Program Files\LanCL\Uninst.exe mCore-->MsiExec.exe /I{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A} mDriver-->MsiExec.exe /I{28DA872A-0848-48CF-B749-19A198157A2A} mDrWiFi-->MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49} mEoU.msi-->MsiExec.exe /I{B502B428-3386-40A9-98DB-079AAB72E64F} mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68} Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office 2003 Bulgarian User Interface Pack-->MsiExec.exe /I{901E0402-6000-11D3-8CFE-0150048383C9} Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9} Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8} Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} mIWA-->MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F} mIWCA-->MsiExec.exe /I{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626} mLogView-->MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7} mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5} Monopoly by Parker Brothers-->C:\PROGRA~1\Hasbro\MONOPO~1\UNWISE.EXE /U C:\PROGRA~1\Hasbro\MONOPO~1\INSTALL.LOG Monopoly� SpongeBob SquarePants� Edition-->C:\PROGRA~1\SHOCKW~1.COM\MONOPO~1\UNWISE.EXE C:\PROGRA~1\SHOCKW~1.COM\MONOPO~1\INSTALL.LOG MOP-->C:\Program Files\MOP\uninstall.exe mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5} mPfWiz-->MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9} mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83} MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} mWlsSafe-->MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4} mXML-->MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401} mZConfig-->MsiExec.exe /I{7CD7A451-7224-49C8-95EF-9A1859C66607} Nero 6 Demo-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL NGWave 3.4-->"C:\Program Files\NGWave 3\unins000.exe" NOD32 antivirus system-->C:\Program Files\Eset\Setup\setup.exe /UNINSTALL Nokia Connectivity Cable Driver-->MsiExec.exe /X{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48} Nokia PC Suite-->C:\Documents and Settings\All Users\Application Data\Installations\{2B8BEBBF-73A0-497D-9900-8474D022AB3F}\Nokia_PC_Suite_rel_7_0_7_0_eng_web.exe Nokia PC Suite-->MsiExec.exe /I{2B8BEBBF-73A0-497D-9900-8474D022AB3F} PC Connectivity Solution-->MsiExec.exe /I{9C7C8898-DC29-4E8B-9E77-55A77C3250F6} Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x9 -removeonly SA Dictionary 2005 T2-->C:\WINDOWS\uninst.exe -f"C:\Program Files\SA Dictionary 2005 T2\DeIsL2.isu" -cC:\PROGRA~1\SADICT~1\_ISREG32.DLL Security Update for Windows Media Player (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe" Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe" Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe" Security Update for Windows Media Player 9 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe" Security Update for Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe" Security Update for Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe" Security Update for Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe" Security Update for Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe" Security Update for Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe" Security Update for Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe" Security Update for Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe" Security Update for Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe" Security Update for Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe" Security Update for Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe" Security Update for Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe" Security Update for Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe" Security Update for Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe" Security Update for Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe" Security Update for Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe" Security Update for Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe" Security Update for Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe" Security Update for Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe" Security Update for Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe" Security Update for Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe" Security Update for Windows XP (KB917344)-->"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe" Security Update for Windows XP (KB917953)-->"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe" Security Update for Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe" Security Update for Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe" Security Update for Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe" Security Update for Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe" Security Update for Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe" Security Update for Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe" Security Update for Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe" Security Update for Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe" Security Update for Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe" Security Update for Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe" Security Update for Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe" Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe" Security Update for Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe" Security Update for Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe" Security Update for Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe" Security Update for Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe" Security Update for Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe" Security Update for Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe" Security Update for Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe" Security Update for Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe" Security Update for Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe" Security Update for Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe" Security Update for Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe" Security Update for Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe" Security Update for Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe" Security Update for Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe" Security Update for Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe" Security Update for Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe" Security Update for Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe" Security Update for Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe" Security Update for Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe" Security Update for Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe" Security Update for Windows XP (KB937143)-->"C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe" Security Update for Windows XP (KB937894)-->"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe" Security Update for Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe" Security Update for Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe" Security Update for Windows XP (KB939653)-->"C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe" Security Update for Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe" Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Security Update for Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe" Security Update for Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe" Security Update for Windows XP (KB942615)-->"C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe" Security Update for Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe" Security Update for Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe" Security Update for Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe" Security Update for Windows XP (KB944338)-->"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe" Security Update for Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe" Security Update for Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe" Security Update for Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe" Security Update for Windows XP (KB947864)-->"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe" Security Update for Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe" Security Update for Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe" Security Update for Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe" Skype� Beta 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} Spyware Doctor 5.1-->C:\Program Files\Spyware Doctor\unins000.exe /LOG Sygate Personal Firewall Pro-->MsiExec.exe /I{3D133CD6-EBDF-4C14-BBB9-5D3AE0BD7C58} Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Unlocker 1.8.5-->C:\Program Files\Unlocker\uninst.exe Update for Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe" Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Update for Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe" Update for Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe" Update for Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe" Update for Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe" Update for Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe" Update for Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe" Update for Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe" Update for Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe" Update for Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe" Update for Windows XP (KB933360)-->"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe" Update for Windows XP (KB936357)-->"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe" Update for Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe" Update for Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe" Update for Windows XP (KB942840)-->"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe" Update for Windows XP (KB946627)-->"C:\WINDOWS\$NtUninstallKB946627$\spuninst\spuninst.exe" USB2.0 1.3M Web Cam-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A87869D7-B133-498C-A347-D9BE109FF6C8}\Setup.exe" -l0x9 Winamp-->"C:\Program Files\Winamp\UninstWA.exe" Windows Driver Package - Nokia Modem (05/22/2008 3.8)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_6F90B0F4A73A2F780A1010B5D6CB5DDFB098181E\nokia_bluetooth.inf Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_E68D50F7E25BFE399D47C864C3B52557346242A9\nokbtmdm.inf Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe" Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe" Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0} Windows Live Photo Gallery-->MsiExec.exe /X{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C} Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" Windows XP Hotfix - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe Windows XP Hotfix - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe Windows XP Hotfix - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe Windows XP Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe Windows XP Hotfix - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe Windows XP Hotfix - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe Windows XP Hotfix - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe" Windows XP Hotfix - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe Your Uninstaller! 2006 Version 5-->"C:\Program Files\Your Uninstaller 2006\unins000.exe" ======Security center information====== AV: Eset NOD32 antivirus system 2.51 FW: Sygate Personal Firewall Pro ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\ATI Technologies\ATI Control Panel;C:\PROGRA~1\DISKEE~1\DISKEE~1 "windir"=%SystemRoot% "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel "PROCESSOR_REVISION"=0d08 "NUMBER_OF_PROCESSORS"=1 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "FP_NO_HOST_CHECK"=NO -----------------EOF----------------- Thanks, Nelina

Egwene View Member Profile	Oct 8 2008, 06:52 AM Post #7
Trusted Helper Posts: 2,141 From: France OS: XP/Vista �dition basique familiale	Hello nelinski250, Let's go on You shouldn't have run combofix : it is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again. http://i266.photobucket.com/albums/ii277/s...mer_ENU_B-1.gif 1) Disable real-time protections : --> Please disable Nod32 and Sygate real-time protections, more help here : http://www.bleepingcomputer.com/forums/topic114351.html 2) Uninstall some programs : Please go Start > Control Panel > Add/Remove Programs and remove the following (if present): Adobe Reader 7.0 Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here : http://www.adobe.com/products/acrobat/readstep2.html 3) Backing up your registry : The steps that I am about to suggest involve modifying the registry. Modfying the registry can be dangerous so we will make a backup of the registry first. Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot preform some of these steps or if you have ANY questions please ask BEFORE proceeding. Backing Up Your Registry Download ERUNT (ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.) Install ERUNT by following the prompts (use the default install settings but say no to the portion that asks you to add ERUNT* to the start-up folder, if you like you can enable this option later)* Start ERUNT (either by double clicking on the desktop icon or choosing to start the program at the end of the setup) Choose a location for the backup (the default location is C:\WINDOWS\ERDNT which is acceptable). Make sure that at least the first two check boxes are ticked Press OK Press YES to create the folder. 4) Run OTmoveIT3 : Please download the OTMoveIt3 by OldTimer. Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): :processes explorer.exe :services winvnc :files C:\WINDOWS\SVCHOST.EXE C:\WINDOWS\system32\jkdejcig.ini C:\WINDOWS\system32\qhqfwuot.ini C:\WINDOWS\system32\b35890ca-.txt C:\WINDOWS\system32\ewaehdjd.ini C:\WINDOWS\system32\ryxcbjmx.ini C:\WINDOWS\system32\rmeaykkj.ini C:\WINDOWS\system32\sisesfoe.ini C:\DOCUME~1\NelkA\Recent\Nero Burning Rom 7.0.8.2 KeyGen.lnk :commands [purity] [emptytemp] [start explorer] [reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. And please post me a fresh RSIT log in your next answer. Regards, Egwene.

nelinski250 View Member Profile	Oct 8 2008, 01:44 PM Post #8
New Member Posts: 8 OS: xp	Hi again Here is the log: ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== Service winvnc stopped successfully. Service winvnc deleted successfully. ========== FILES ========== File/Folder C:\WINDOWS\SVCHOST.EXE not found. C:\WINDOWS\system32\jkdejcig.ini moved successfully. C:\WINDOWS\system32\qhqfwuot.ini moved successfully. C:\WINDOWS\system32\b35890ca-.txt moved successfully. C:\WINDOWS\system32\ewaehdjd.ini moved successfully. C:\WINDOWS\system32\ryxcbjmx.ini moved successfully. C:\WINDOWS\system32\rmeaykkj.ini moved successfully. C:\WINDOWS\system32\sisesfoe.ini moved successfully. C:\DOCUME~1\NelkA\Recent\Nero Burning Rom 7.0.8.2 KeyGen.lnk moved successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_61c.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.4.2 log created on 10082008_193834 Files moved on Reboot... File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. File C:\WINDOWS\temp\Perflib_Perfdata_61c.dat not found! And this is the log from RSIT: Logfile of random's system information tool 1.04 (written by random/random) Run by NelkA at 2008-10-08 22:43:17 Microsoft Windows XP Professional Service Pack 2 System drive C: has 6 GB (22%) free of 27 GB Total RAM: 1023 MB (53% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:43:22, on 08.10.2008 г. Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\NelkA\Desktop\RSIT.exe C:\Program Files\trend micro\NelkA.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.data.bg/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: FlexType 2K.lnk = C:\Program Files\Datecs\FlexType 2K\FType2K.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) - https://ebb.ubb.bg/CAPICOM/capicom.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe -- End of file - 6225 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0000CC75-ACF3-4cac-A0A9-DD3868E06852}] DAPHelper Class - C:\Program Files\DAP\DAPBHO.dll [2007-10-02 98304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2007-10-18 1373480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SmcService"=C:\PROGRA~1\Sygate\SPF\smc.exe [2005-06-06 2614496] "IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2005-05-31 401408] "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-12-22 98394] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-12-22 688218] "HControl"=C:\WINDOWS\ATK0100\HControl.exe [2005-07-28 102400] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-09-06 14850560] "BluetoothAuthenticationAgent"=C:\WINDOWS\system32\bthprops.cpl [2004-08-04 110592] "nod32kui"=C:\Program Files\Eset\nod32kui.exe [2008-10-04 921600] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "BITS"=3 C:\Documents and Settings\All Users\Start Menu\Programs\Startup FlexType 2K.lnk - C:\Program Files\Datecs\FlexType 2K\FType2K.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2005-08-30 46080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [2005-05-31 110592] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier] WRLogonNTF.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "NoDrives"= "NoDriveAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\BitSpirit\BitSpirit.exe"="C:\Program Files\BitSpirit\BitSpirit.exe::Enabled:The powerful and easy-to-use BitTorrent Client" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe::Enabled:Windows Messenger" "C:\Program Files\ICQLite\ICQLite.exe"="C:\Program Files\ICQLite\ICQLite.exe::Enabled:ICQ Lite" "D:\GAMES\Counter-Strike Source\hl2.exe"="D:\GAMES\Counter-Strike Source\hl2.exe::Enabled:hl2" "C:\Program Files\Duke Nukem - Manhattan Project\prism3d.exe"="C:\Program Files\Duke Nukem - Manhattan Project\prism3d.exe::Enabled:prism3d" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe::Enabled:CyberLink PowerDVD 8.0" "C:\Program Files\DAP\DAP.exe"="C:\Program Files\DAP\DAP.exe::Enabled:Download Accelerator Plus" "D:\GAMES\Taxi3 eXtreme Rush\Extreme Rush.exe"="D:\GAMES\Taxi3 eXtreme Rush\Extreme Rush.exe::Enabled:eXtreme Rush" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe::Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe::Enabled:CyberLink PowerDVD 8.0" ======List of files/folders created in the last 1 months====== 2008-10-08 19:36:12 ----D---- C:\Program Files\ERUNT 2008-10-08 19:31:05 ----SHD---- C:\Config.Msi 2008-10-08 15:58:45 ----D---- C:\Program Files\URUSoft 2008-10-08 13:37:10 ----D---- C:\Documents and Settings\NelkA\Application Data\Media Player Classic 2008-10-08 10:45:59 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2008-10-08 10:45:59 ----A---- C:\WINDOWS\system32\pndx5032.dll 2008-10-08 10:45:59 ----A---- C:\WINDOWS\system32\pndx5016.dll 2008-10-08 10:45:59 ----A---- C:\WINDOWS\system32\pncrt.dll 2008-10-08 10:45:58 ----A---- C:\WINDOWS\system32\unrar.dll 2008-10-08 10:45:46 ----A---- C:\WINDOWS\system32\yv12vfw.dll 2008-10-08 10:45:46 ----A---- C:\WINDOWS\system32\xvidvfw.dll 2008-10-08 10:45:46 ----A---- C:\WINDOWS\system32\xvidcore.dll 2008-10-08 10:45:45 ----A---- C:\WINDOWS\system32\qt-dx331.dll 2008-10-08 10:45:45 ----A---- C:\WINDOWS\system32\dpl100.dll 2008-10-08 10:45:40 ----A---- C:\WINDOWS\system32\divx.dll 2008-10-08 10:45:39 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-10-08 10:45:39 ----A---- C:\WINDOWS\system32\ff_vfw.dll 2008-10-08 10:45:36 ----D---- C:\Program Files\K-Lite Codec Pack 2008-10-08 10:45:36 ----D---- C:\Documents and Settings\NelkA\Application Data\Real 2008-10-08 10:45:36 ----D---- C:\Documents and Settings\All Users\Application Data\Real 2008-10-08 10:28:50 ----D---- C:\Program Files\DirectVobSub 2008-10-08 10:03:11 ----D---- C:\rsit 2008-10-08 10:03:11 ----D---- C:\Program Files\trend micro 2008-10-07 16:45:30 ----A---- C:\WINDOWS\system32\NeroCheck.exe 2008-10-07 16:40:25 ----D---- C:\Program Files\Ahead 2008-10-07 16:03:01 ----SHD---- C:\RECYCLER 2008-10-07 14:41:33 ----D---- C:\Lop SD 2008-10-07 14:10:07 ----D---- C:\Documents and Settings\NelkA\Application Data\Malwarebytes 2008-10-07 14:09:51 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-07 13:35:20 ----A---- C:\Boot.bak 2008-10-07 13:35:09 ----D---- C:\cmdcons 2008-10-07 13:34:00 ----D---- C:\WINDOWS\erdnt 2008-10-07 13:31:54 ----D---- C:\QooBox 2008-10-07 13:31:36 ----A---- C:\WINDOWS\zip.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\VFIND.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\SWREG.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\sed.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\grep.exe 2008-10-07 13:31:36 ----A---- C:\WINDOWS\fdsv.exe 2008-10-07 13:31:35 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-10-07 13:31:35 ----A---- C:\WINDOWS\SWSC.exe 2008-10-07 13:14:18 ----A---- C:\WINDOWS\nircmd.exe 2008-10-07 13:03:27 ----D---- C:\Program Files\HijackThis 2008-10-07 12:09:54 ----D---- C:\VundoFix Backups 2008-10-07 10:15:04 ----D---- C:\WINDOWS\system32\NtmsData 2008-10-07 09:34:20 ----A---- C:\WINDOWS\WRUninstall.dll 2008-10-07 09:34:20 ----A---- C:\WINDOWS\ssleay32.dll 2008-10-07 09:34:20 ----A---- C:\WINDOWS\libeay32.dll 2008-10-04 22:07:26 ----A---- C:\WINDOWS\system32\imon.dll 2008-09-17 16:50:00 ----D---- C:\Program Files\Favorite-Games ======List of files/folders modified in the last 1 months====== 2008-10-08 22:39:53 ----D---- C:\WINDOWS\Temp 2008-10-08 19:42:40 ----D---- C:\WINDOWS\system32\Lang 2008-10-08 19:41:13 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-10-08 19:38:51 ----D---- C:\WINDOWS\system32 2008-10-08 19:37:29 ----D---- C:\WINDOWS\Prefetch 2008-10-08 19:36:12 ----RD---- C:\Program Files 2008-10-08 19:31:44 ----SHD---- C:\WINDOWS\Installer 2008-10-08 19:31:08 ----D---- C:\Program Files\Common Files 2008-10-08 19:30:15 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-08 16:12:08 ----D---- C:\Documents and Settings\NelkA\Application Data\Skype 2008-10-08 13:37:44 ----A---- C:\WINDOWS\NeroDigital.ini 2008-10-08 10:42:19 ----D---- C:\WINDOWS 2008-10-07 16:45:46 ----D---- C:\WINDOWS\system32\drivers 2008-10-07 16:45:30 ----D---- C:\Program Files\Common Files\Ahead 2008-10-07 16:35:42 ----D---- C:\Program Files\BookReader 2008-10-07 15:07:37 ----D---- C:\WINDOWS\system32\CatRoot2 2008-10-07 13:46:06 ----A---- C:\WINDOWS\system.ini 2008-10-07 13:42:29 ----D---- C:\WINDOWS\system32\config 2008-10-07 13:38:11 ----D---- C:\WINDOWS\AppPatch 2008-10-07 13:36:19 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-10-07 13:35:20 ----RASH---- C:\boot.ini 2008-10-07 10:28:18 ----D---- C:\Documents and Settings 2008-10-07 10:21:37 ----D---- C:\WINDOWS\system32\Restore 2008-10-07 10:19:59 ----D---- C:\WINDOWS\repair 2008-10-07 10:19:38 ----D---- C:\WINDOWS\Registration 2008-10-07 10:15:02 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-10-05 21:01:46 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-10-05 20:23:33 ----SHD---- C:\System Volume Information 2008-10-04 22:55:56 ----D---- C:\Program Files\ESET 2008-10-03 18:11:48 ----D---- C:\Documents and Settings\NelkA\Application Data\Ahead 2008-10-03 17:41:45 ----HD---- C:\WINDOWS\inf 2008-09-21 16:19:04 ----D---- C:\WINDOWS\system32\wbem 2008-09-21 16:18:38 ----D---- C:\WINDOWS\security ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096] R1 wpsdrvnt;wpsdrvnt; \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys [] R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-10-03 17801] R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys [] R2 irda;IrDA Protocol; C:\WINDOWS\System32\DRIVERS\irda.sys [2004-08-03 87424] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-01-17 13059] R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2005-05-03 11354] R2 wg3n;SyGate for NT, wg3n; C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys [2005-06-06 14448] R2 wg4n;SyGate for NT, wg4n; C:\WINDOWS\SYSTEM32\Drivers\wg4n.sys [2005-06-06 14448] R2 wg5n;SyGate for NT, wg5n; C:\WINDOWS\SYSTEM32\Drivers\wg5n.sys [2005-06-06 14448] R2 wg6n;SyGate for NT, wg6n; C:\WINDOWS\SYSTEM32\Drivers\wg6n.sys [2005-06-06 14448] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800] R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2005-08-30 1333760] R3 BthEnum;Bluetooth Request Block Driver; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-03 17024] R3 BTHMODEM;Bluetooth Modem Communications Driver; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2004-08-03 38016] R3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992] R3 BTHUSB;Bluetooth Radio USB Driver; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-03 18944] R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2004-08-03 14080] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-23 9600] R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2005-01-17 1036928] R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2005-01-17 163328] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-09-08 3959808] R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\System32\DRIVERS\irsir.sys [2001-08-17 18688] R3 IWCA;Intel Wireless Connection Agent Miniport for Win XP; C:\WINDOWS\system32\DRIVERS\iwca.sys [2004-08-12 234496] R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-23 12160] R3 MTsensor;ATK0100 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ATKACPI.sys [2005-02-17 5632] R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824] R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2004-08-03 59648] R3 SynMini;USB2.0 1.3M Web Cam; C:\WINDOWS\System32\Drivers\SynMini.sys [2005-08-26 720438] R3 SynScan;USB2.0 1.3M Web Cam Still Image; C:\WINDOWS\System32\Drivers\SynScan.sys [2005-09-09 8246] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-12-22 186240] R3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2004-12-21 34816] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480] R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2005-04-30 3281408] R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-01-17 702592] R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\yukonwxp.sys [2004-06-02 142464] S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2004-08-03 14848] S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2004-10-04 62799] S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2004-08-03 274304] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920] S3 IKFileSec;File Security Driver; C:\WINDOWS\system32\drivers\ikfilesec.sys [2007-10-18 41288] S3 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2007-12-17 56832] S3 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2007-12-17 74240] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632] S3 sdbus;sdbus; C:\WINDOWS\System32\DRIVERS\sdbus.sys [2004-08-03 67584] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:\WINDOWS\system32\drivers\Toshidpt.sys [2002-10-16 2851] S3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\system32\DRIVERS\tosporte.sys [2005-03-30 47230] S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2005-07-04 98176] S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2004-07-08 36531] S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys [2005-06-27 53504] S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:\WINDOWS\system32\DRIVERS\tosrfnds.sys [2005-01-06 18612] S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:\WINDOWS\system32\drivers\TosRfSnd.sys [2005-04-06 50048] S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264] S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 vsdatant;vsdatant; C:\WINDOWS\system32\drivers\vsdatant.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2005-08-30 376832] R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336] R2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2007-10-16 1094936] R2 EvtEng;EvtEng; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2005-06-03 86016] R2 Irmon;Infrared Monitor; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336] R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2008-10-04 507904] R2 OwnershipProtocol;OwnershipProtocol; C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe [2005-05-31 98304] R2 RegSrvc;RegSrvc; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2005-06-03 139264] R2 S24EventMonitor;Spectrum24 Event Monitor; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2005-06-03 372809] R2 SmcService;Sygate Personal Firewall Pro; C:\Program Files\Sygate\SPF\smc.exe [2005-06-06 2614496] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\svcntaux.exe [2007-11-02 311112] S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\swdsvc.exe [2007-11-02 1418056] S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-05-30 572416] S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328] S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] -----------------EOF----------------- Regards, Nelina

Egwene View Member Profile	Oct 8 2008, 03:44 PM Post #9
Trusted Helper Posts: 2,141 From: France OS: XP/Vista �dition basique familiale	Hello nelinski250, Please do an online scan with Kaspersky WebScanner Make sure you are using Internet Explorer for this. Click on Kaspersky Online Scanner and click Accept You will be prompted to install an ActiveX component from Kaspersky, Click Yes. The program will launch and then begin downloading the latest definition files: Once the files have been downloaded click on NEXT Now click on Scan Settings In the scan settings make that the following are selected: Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Options: Scan Archives Scan Mail Bases Click OK Now under select a target to scan: Select My Computer This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Now click on the Save as Text button: Save the file to your desktop. Copy and paste that information in your next post. And please tell me how your computer is running now. Regards, Egwene.

nelinski250 View Member Profile	Oct 9 2008, 02:49 AM Post #10
New Member Posts: 8 OS: xp	Hey, Here is Kaspersky log -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Thursday, October 9, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Thursday, October 09, 2008 07:10:39 Records in database: 1300012 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics: Files scanned: 103436 Threat name: 7 Infected objects: 8 Suspicious objects: 0 Duration of the scan: 01:50:00 File name / Threat name / Threats count C:\Program Files\ESET\infected\1VL4OJBA.NQF Infected: Worm.Win32.AutoRun.dye 1 C:\Program Files\ESET\infected\WD0SPHDA.NQF Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.ap 1 C:\Program Files\ESET\infected\WD0SPHDA.NQF Infected: Trojan.Win32.Small.bgi 1 C:\Program Files\ESET\infected\ZT3RKICA.NQF Infected: Trojan.Win32.Monderb.ryr 1 C:\QooBox\Quarantine\C\WINDOWS\system32\djdheawe.dll.vir Infected: Trojan.Win32.Agent.agdb 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jkkyaemr.dll.vir Infected: Trojan.Win32.Agent.agdb 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vxfkurkn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.alxp 1 D:\Downloads\PRO\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 The selected area was scanned. And the laptop is running fine, only at the beginig it asks me to choose from Windows xp professional and windows recovery console or something like that, how can I remove this recovery something..? Everything else is fine thanks to you. One Big Thank You For You!!! Nelina

nelinski250 View Member Profile	Oct 9 2008, 02:54 AM Post #11
New Member Posts: 8 OS: xp	P.S. And just one more thing...this ssiefr.exe is still here, and how can I remove this?

Egwene View Member Profile	Oct 9 2008, 03:35 PM Post #12
Trusted Helper Posts: 2,141 From: France OS: XP/Vista �dition basique familiale	(nelinski250 @ Oct 9 2008, 10:54 AM) P.S. And just one more thing...this ssiefr.exe is still here, and how can I remove this? Why do you think this ssiefr.exe is still present ? I don't see it in your logs. Regards, Egwene.

nelinski250 View Member Profile	Oct 11 2008, 09:54 AM Post #13
New Member Posts: 8 OS: xp	Hi again. I wrote you an answer but now it's lost I don't know how's that possible! Everything is perfect with my computer, except the windows recovery console and the ssiefr.exe. When I start my pc first it ask me to choose between windows recovery console and windows xp and automatically starts the windows xp. After that on a blue screen it starts a message ssiefr.exe not found - autocheck....something. That's what bothers me! Thank you, Nelina

Egwene View Member Profile	Oct 11 2008, 11:31 AM Post #14
Trusted Helper Posts: 2,141 From: France OS: XP/Vista �dition basique familiale	Hello, Please read this first : http://www.geekstogo.com/forum/Read-Good-B...ly-t214194.html Please uninstall SpySweeper and reboot your computer. Your issue is fixed ? Regards, Egwene. This post has been edited by Egwene: Oct 11 2008, 11:32 AM

Egwene View Member Profile	Oct 15 2008, 01:40 AM Post #15
Trusted Helper Posts: 2,141 From: France OS: XP/Vista �dition basique familiale	Due to lack of feedback, this topic has been closed. If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal win32/Adware VirtuMonde Help [CLOSED]	2 / 1,684	22nd June 2008 - 05:58 PM MrVirus started - last by Rorschach112
Virus, Spyware and Trojan Removal win32/adware.virtumonde removal [CLOSED]	3 / 1,664	28th August 2008 - 06:59 AM Zareck22 started - last by IndiGenus
Virus, Spyware and Trojan Removal Help with win32/adware.virtumonde and win32/privacyremover.m64 [CLOSED	3 / 988	28th August 2008 - 06:58 AM Ineedsomehelp started - last by IndiGenus
Virus, Spyware and Trojan Removal problem removeing a win32/adware.virtumonde.neo [Closed]	10 / 832	6th May 2009 - 12:34 AM nick443 started - last by Blade81