ZeroAccess?95.p?MediaShifting?

[oversoulzzz91]

Hi.

1st of all, i would like to apologize because last day i intefered someone forum.

Maybe this kind of problem expertise malware have solved it.

but, the problem is i don't know where to start to solve my problem when i read in other's post.

I really appreciate if expertise would show the way to solve this thing up.

I would like to attach RKreport because i see my system have been infected by BackDoor Trojan : ZeroAccess.

The problem is, i don't know how to start over. What next step must i take?

I really appreciate it.

Thanks a lot.

dds.txt

RKreport1.txt

Sorry cuz im forgot to paste the DDS log.

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_29

Run by DIGIT at 3:54:51 on 2012-01-08

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3002.2073 [GMT 5.5:30]

.

AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe

C:\WINDOWS\system32\WinFLService.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

c:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe

C:\Program Files\Cyberlink\Shared files\brs.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

C:\Program Files\e-Kamus\Kamus50207.exe

C:\Program Files\Conceptworld\NoteZilla\NoteZilla.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\WINDOWS\system32\WinFLTray.exe

C:\Program Files\NewSoftware's\Folder Lock\FLComServCtrl.exe

C:\Program Files\NewSoftware's\Folder Lock\FLComServ.exe

C:\Program Files\Ninja 1.6\Ninja.exe

C:\Program Files\Rainlendar2.6\Rainlendar2.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\SolidWorks\swScheduler\swBOEngine.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\DOCUME~1\DIGIT\LOCALS~1\Temp\RtkBtMnt.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.ChatVibes.com

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://search.ChatVibes.com

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

uURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - c:\program files\chatvibes toolbar\tbhelper.dll

BHO: IDM integration (IDMIEHlprObj Class): {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: FMTLB0003 Class: {0ec9148f-41e2-437c-8437-e576fe833a52} - c:\program files\chatvibes toolbar\tbcore3.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll

BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2012\ievkbd.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office14\GROOVEEX.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~3\office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Microsoft Web Test Recorder 10.0 Helper: {dda57003-0068-4ed2-9d32-4d1ec707d94d} - c:\program files\microsoft visual studio 10.0\common7\ide\privateassemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll

BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2012\klwtbbho.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll

TB: ChatVibes Toolbar: {01193d00-c7f9-4c26-92a2-1ca91f170068} - c:\program files\chatvibes toolbar\tbcore3.dll

EB: Web Test Recorder 10.0: {5802d092-1784-4908-8cdb-99b6842d353d} - mscoree.dll

EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet

uRun: [OfficeSyncProcess] "c:\program files\microsoft office\office14\MSOSYNC.EXE"

uRun: [Kamus502] c:\program files\e-kamus\Kamus50207.exe

uRun: [NoteZilla] c:\program files\conceptworld\notezilla\NoteZilla.exe

uRun: [QNPlus]

uRun: [iDMan] c:\program files\internet download manager\IDMan.exe /onboot

uRun: [WinFLTray] c:\windows\system32\WinFLTray.exe

uRun: [FLBackup] c:\program files\newsoftware's\folder lock\FLComServCtrl.exe

mRun: [AzMixerSel] c:\program files\realtek\audio\installshield\AzMixerSel.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"

mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [RemoteControl10] "c:\program files\cyberlink\powerdvd10\PDVD10Serv.exe"

mRun: [bDRegion] c:\program files\cyberlink\shared files\brs.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices

mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2012\avp.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32

StartupFolder: c:\docume~1\digit\startm~1\programs\startup\ninja.lnk - c:\program files\ninja 1.6\Ninja.exe

StartupFolder: c:\docume~1\digit\startm~1\programs\startup\rainle~1.lnk - c:\program files\rainlendar2.6\Rainlendar2.exe

StartupFolder: c:\docume~1\digit\startm~1\programs\startup\rocket~1.lnk - c:\program files\rocketdock\RocketDock.exe

StartupFolder: c:\docume~1\digit\startm~1\programs\startup\solidw~1.lnk - c:\program files\solidworks\swscheduler\swBOEngine.exe

uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)

IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2012\ie_banner_deny.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm

IE: Download with IDM - c:\program files\internet download manager\IEExt.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\micros~3\office14\ONBttnIE.dll/105

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2012\ievkbd.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2012\klwtbbho.dll

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{50F2AF02-C20C-4CCE-B938-302BD11F66AB} : DhcpNameServer = 192.168.1.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: brx - {9C160F90-74D1-11D3-AB60-0060977C1F29} - c:\program files\common files\bricscad\BrxProtIE.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Notify: igfxcui - igfxdev.dll

Notify: klogon - c:\windows\system32\klogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\digit\application data\mozilla\firefox\profiles\vwcrr6uj.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2710626&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.my/

FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties

FF - component: c:\documents and settings\digit\application data\idm\idmmzcc3\components\idmmzcc.dll

FF - component: c:\documents and settings\digit\application data\mozilla\firefox\profiles\vwcrr6uj.default\extensions\{2bcf3d7a-1ada-4ffd-8029-3759e7ee8f7c}\components\RadioWMPCore.dll

FF - component: c:\documents and settings\digit\application data\mozilla\firefox\profiles\vwcrr6uj.default\extensions\{2bcf3d7a-1ada-4ffd-8029-3759e7ee8f7c}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\digit\application data\mozilla\firefox\profiles\vwcrr6uj.default\extensions\engine@conduit.com\components\RadioWMPCore.dll

FF - component: c:\documents and settings\digit\application data\mozilla\firefox\profiles\vwcrr6uj.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll

FF - plugin: c:\documents and settings\digit\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll

FF - plugin: c:\progra~1\micros~3\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll

FF - plugin: c:\program files\veetle\player\npvlc.dll

FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

============= SERVICES / DRIVERS ===============

.

R0 KL1;kl1;c:\windows\system32\drivers\kl1.sys [2011-3-4 133208]

R1 IDMTDI;IDMTDI;c:\windows\system32\drivers\idmtdi.sys [2011-10-1 101616]

R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2011-3-4 11352]

R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2011-10-12 565552]

R1 WinFLAdrv;WinFLAdrv;c:\windows\system32\WinFLAdrv.sys [2012-1-6 30608]

R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/11/07 15:40:54];c:\program files\cyberlink\powerdvd10\navfilter\000.fcl [2010-4-2 87536]

R2 AVP;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky internet security 2012\avp.exe [2011-4-24 202296]

R2 FLService;FLService;c:\windows\system32\WinFLService.exe [2012-1-6 96856]

R2 NEWDRIVER;NEWDRIVER;c:\windows\system32\WinVDEdrv6.sys [2012-1-6 188176]

R2 PfFilter;PfFilter;c:\program files\iobit\protected folder\pffilter.sys [2011-12-27 140848]

R2 WinVDEDrv;WinVDEDrv;c:\windows\system32\WinVDEdrv.sys [2012-1-6 228112]

R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2010-11-2 84240]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2011-3-10 34608]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19472]

R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [2010-11-2 637824]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\solidworks\swscheduler\DTSCoordinatorService.exe [2008-9-9 79144]

S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2011-1-5 114432]

S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\garena plus\room\safedrv.sys --> c:\program files\garena plus\room\safedrv.sys [?]

S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2011-1-5 100736]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]

S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

S3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files\microsoft visual studio 10.0\team tools\performance tools\VSPerfDrv100.sys [2009-12-8 48128]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-23 47128]

S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]

.

=============== Created Last 30 ================

.

2012-01-07 21:56:26 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-01-07 21:41:23 -------- d-----w- c:\documents and settings\digit\application data\Malwarebytes

2012-01-07 21:41:15 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2012-01-07 21:36:13 -------- d-----w- c:\program files\Magical Jelly Bean

2012-01-06 16:57:30 30608 ----a-w- c:\windows\system32\WinFLAdrv.sys

2012-01-06 16:57:29 188176 ----a-w- c:\windows\system32\WinVDEdrv6.sys

2012-01-06 16:57:28 228112 ----a-w- c:\windows\system32\WinVDEdrv.sys

2012-01-06 16:57:09 96856 ----a-w- c:\windows\system32\WinFLService.exe

2012-01-06 16:57:08 14936 ----a-w- c:\windows\system32\WinFLMsgService.exe

2012-01-06 16:57:06 315992 ----a-w- c:\windows\system32\WinFLTray.exe

2012-01-06 16:57:05 315992 ----a-w- c:\windows\system32\WinFLTrayShred.exe

2012-01-06 16:57:02 -------- d-----w- c:\program files\NewSoftware's

2012-01-06 05:37:45 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys

2012-01-05 10:32:32 -------- d-----w- c:\windows\system32\LogFiles

2012-01-04 11:55:14 -------- d-----w- c:\documents and settings\digit\application data\GarenaPlus

2012-01-04 11:54:55 -------- d-----w- c:\program files\Garena Plus

2012-01-04 11:54:41 -------- d-----w- c:\documents and settings\all users\application data\GarenaMessenger

2012-01-04 10:07:02 -------- d-----w- c:\program files\themexp.org

2011-12-27 16:07:37 -------- d-----w- c:\program files\IObit

2011-12-27 16:07:37 -------- d-----w- c:\documents and settings\all users\application data\IObit

2011-12-25 17:06:22 -------- d-sh--w- c:\documents and settings\digit\local settings\application data\5c802fdf

2011-12-25 16:41:26 474112 ----a-w- c:\windows\system32\WinFLCtxMenu.dll

2011-12-23 03:39:35 -------- d-----w- c:\program files\Internet Download Manager

2011-12-23 03:28:45 -------- d-----w- c:\documents and settings\digit\application data\IDM

2011-12-15 02:26:46 -------- d-----w- c:\documents and settings\digit\application data\Conceptworld

2011-12-15 02:26:38 1060864 ----a-w- c:\windows\system32\mfc71.dll

2011-12-15 02:26:38 -------- d-----w- c:\program files\Conceptworld

2011-12-10 10:21:17 -------- d-----w- c:\program files\Quran_in_Word

.

==================== Find3M ====================

.

2012-01-06 16:57:07 40960 ----a-w- c:\windows\system32\nwsftUninstall.exe

2011-12-31 11:06:11 151552 ----a-w- c:\windows\KMSEmulator.exe

2011-12-25 17:16:02 13312 ----a-r- c:\windows\system32\agrsmsvc.exe

2011-11-23 13:29:56 1868544 ----a-w- c:\windows\system32\win32k.sys

2011-11-22 12:45:48 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 19:20:51 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec

2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll

2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-25 13:38:37 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-25 12:52:33 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll

2011-10-10 14:21:17 692736 ----a-w- c:\windows\system32\inetcomm.dll

.

============= FINISH: 4:01:07.48 ===============

FSS.txt

[oversoulzzz91]

Sorry if this reply make unused to all..

Is this can't be solved?

please help deh.

[Larusso]

Sorry for the delay. We do our best to answer all topics but sometimes we miss one.

My name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

• First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  
• Perform everything in the correct order. Sometimes one step requires the previous one.
  
• If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  
• Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  
• Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  
• Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  
• My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Please delete the current version of DDS.

Download DDS and save it to your desktop from here or here

Double click dds to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt

  [*]Save both reports to your desktop and post them in your next reply

Please download Gmer from here and save it to your Desktop.

• Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  • Sections
    
  • IAT/EAT
    
  • Drives/Partition other than Systemdrive (typically C:\)
    
  • Show All (don't miss this one)

  [*] Then click the Scan button & wait for it to finish.

  [*] Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.

  [*]Save it where you can easily find it, such as your desktop

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Please post in your next reply

dds.txt

attach.txt

ark.txt

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!