Jump to content

Task manager


Recommended Posts

Hi to everyone out there, i hav a problem with task manger, whenever i press Clt, alt, delete, instead of the task manager, windows pop up a message saying

task manager have been disable by the administrator, also when try to run regedit, the same message came out. if anyone knows hw to solve this pls help me out, thx in advance.

MBAM Log -

-----------------------------------

Malwarebytes' Anti-Malware 1.30

Database version: 1349

Windows 5.1.2600 Service Pack 3

11/1/2008 6:15:03 PM

mbam-log-2008-11-01 (18-15-03).txt

Scan type: Full Scan (C:\|)

Objects scanned: 123766

Time elapsed: 28 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

----------------------------------

Panda scan

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-11-01 17:42:36

PROTECTIONS: 0

MALWARE: 9

SUSPECTS: 1

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinDisableri1.zip

00055170 mIRC/Gen Virus/Worm No 0 Yes No C:\Program Files\ZincPlay\Zion\mirc.ini

00055170 mIRC/Gen Virus/Worm No 0 Yes No C:\Program Files\ZincPlay\Zion\defaults\mirc.ini

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Zj\Cookies\zj@atdmt[1].txt

00172825 Joke/Stress Jokes No 0 Yes No C:\Documents and Settings\Zj\Desktop\Mass Folder\Desktop Pet\stress reducers.exe

00249874 application/alfacleaner HackTools No 0 Yes No c:\documents and settings\zj\application data\skinux

00366659 Trj/Flashy.B Virus/Trojan Yes 1 Yes No C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif

00366659 Trj/Flashy.B Virus/Trojan No 0 Yes No c:\windows\system32\flashy.exe

00366659 Trj/Flashy.B Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0019276.exe

00437348 Trj/Multidropper.ROJ Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][keygen.exe]

03939461 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][serial.exe]

03955213 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][install.exe]

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location

;===============================================================================

================================================================================

=

===================

No C:\Program Files\ZincPlay\Zion\mirc.exe

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

HiJack This Scan

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:44:30 PM, on 11/1/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PPStream\ppsap.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)

O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Program Files\PPLiveVA\DownloaderManager.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe

O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Flashy Bot] C:\WINDOWS\system32\Flashy.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe

O4 - HKCU\..\Run: [PPLiveVA] C:\Program Files\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [iDMan] C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe /onboot

O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: systemID.pif = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Download all links with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetAll.htm

O8 - Extra context menu item: Download FLV video content with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetVL.htm

O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000

O8 - Extra context menu item: Download with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEExt.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button:

Link to post
Share on other sites

Hello

Disable resident protections (Antivirus...); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe

Choose the language, then choose Option 1 (Search)

Wait till the end of the scan

Post the log which is created: (%SystemDrive%\lopR.txt)

Hi, again

here's the log

--------------------\\ Lop S&D 4.2.4-9b XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Intel® Core2 Duo CPU E6750 @ 2.66GHz )

BIOS : Default System BIOS

USER : Zj ( Administrator )

BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:298 Go (Free:29 Go)

D:\ (CD or DVD)

E:\ (CD or DVD)

F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|04:15 )

Option : [1] ( Sat 11/01/2008|23:56 )

--------------------\\ Listing folders in APPLIC~1

[10/25/2008|08:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> {0691F710-1ECA-4B5A-9727-25554F1BFDC6}

[10/27/2008|05:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> {3276BE95_AF08_429F_A64F_CA64CB79BCF6}

[10/18/2008|12:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe

[08/21/2008|02:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple

[08/21/2008|02:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer

[09/26/2008|11:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Creative

[09/30/2008|10:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> DAEMON Tools Pro

[09/27/2008|07:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Jlcm

[08/25/2008|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Kodak

[10/16/2008|10:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> KONAMI

[08/20/2008|10:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes

[09/11/2008|10:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft

[10/16/2008|03:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft Help

[09/29/2008|01:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Naked Brothers Band

[10/01/2008|04:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLive

[10/12/2008|08:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLiveVA

[11/01/2008|04:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLiveVAPPLiveVAShareFlv

[11/01/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy

[10/31/2008|11:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SUPERAntiSpyware.com

[09/23/2008|11:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Thunder Network

[10/31/2008|02:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> thunder_vod_cache

[10/12/2008|03:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TVU Networks

[08/24/2008|02:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage

[09/11/2008|10:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller

[10/30/2008|10:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Yahoo! Companion

[08/20/2008|10:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

[08/20/2008|10:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft

[08/20/2008|10:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

[10/18/2008|12:22] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Adobe

[08/22/2008|02:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Apple Computer

[08/22/2008|12:10] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Bearshare Premium P2P

[09/11/2008|02:14] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Carnival Software

[09/26/2008|11:00] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Creative

[08/20/2008|11:11] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DAEMON Tools

[09/30/2008|10:07] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DAEMON Tools Pro

[11/01/2008|04:32] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DMCache

[09/23/2008|04:26] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Gearbox Software

[09/25/2008|03:19] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Hamachi

[09/28/2008|07:13] C:\DOCUME~1\Zj\APPLIC~1\<DIR> HTML Executable

[08/20/2008|10:09] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Identities

[09/17/2008|01:29] C:\DOCUME~1\Zj\APPLIC~1\<DIR> IDM

[08/25/2008|01:22] C:\DOCUME~1\Zj\APPLIC~1\<DIR> ImgBurn

[10/02/2008|03:48] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Leadertech

[08/20/2008|08:39] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Macromedia

[08/20/2008|10:41] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Malwarebytes

[08/22/2008|02:28] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Media Player Classic

[09/22/2008|01:42] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Microsoft

[09/28/2008|12:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> mIRC

[08/20/2008|10:27] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Mozilla

[09/24/2008|03:31] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPLive

[09/27/2008|08:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPLiveVA

[10/02/2008|03:16] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPStream

[08/22/2008|10:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Real

[08/20/2008|08:07] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SecuROM

[09/11/2008|06:28] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Shareaza

[08/24/2008|05:45] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Skinux

[09/11/2008|06:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SPORE

[09/17/2008|01:34] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Sun

[10/31/2008|11:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SUPERAntiSpyware.com

[08/20/2008|08:30] C:\DOCUME~1\Zj\APPLIC~1\<DIR> TmpRecentIcons

[09/27/2008|08:19] C:\DOCUME~1\Zj\APPLIC~1\<DIR> TVU Networks

[11/01/2008|11:52] C:\DOCUME~1\Zj\APPLIC~1\<DIR> uTorrent

[09/24/2008|03:48] C:\DOCUME~1\Zj\APPLIC~1\<DIR> vlc

[08/20/2008|10:36] C:\DOCUME~1\Zj\APPLIC~1\<DIR> WinRAR

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[10/27/2008 05:30 PM][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[11/01/2008 04:13 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT

[08/24/2001 04:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[10/08/2008|11:02] C:\Program Files\<DIR> 7-Zip

[10/14/2008|11:42] C:\Program Files\<DIR> Activision

[10/18/2008|12:22] C:\Program Files\<DIR> Adobe

[09/21/2008|06:52] C:\Program Files\<DIR> AGEIA Technologies

[09/11/2008|06:14] C:\Program Files\<DIR> Apple Software Update

[08/22/2008|05:09] C:\Program Files\<DIR> Ares

[09/02/2008|03:16] C:\Program Files\<DIR> AviSynth 2.5

[09/28/2008|07:46] C:\Program Files\<DIR> Bonjour

[09/11/2008|02:14] C:\Program Files\<DIR> Caricature Studio Green 3.6

[08/20/2008|11:19] C:\Program Files\<DIR> CCleaner

[10/18/2008|12:22] C:\Program Files\<DIR> Common Files

[09/27/2008|03:14] C:\Program Files\<DIR> Creative

[09/30/2008|10:08] C:\Program Files\<DIR> DAEMON Tools Pro

[09/02/2008|01:13] C:\Program Files\<DIR> Devious Codeworks

[08/25/2008|01:00] C:\Program Files\<DIR> DVD Decrypter

[09/11/2008|11:13] C:\Program Files\<DIR> EA GAMES

[10/02/2008|03:38] C:\Program Files\<DIR> EA Sports

[10/25/2008|08:40] C:\Program Files\<DIR> Electronic Arts

[11/01/2008|09:01] C:\Program Files\<DIR> eMule

[09/02/2008|03:16] C:\Program Files\<DIR> eRightSoft

[09/06/2008|11:11] C:\Program Files\<DIR> Hamachi

[08/25/2008|01:05] C:\Program Files\<DIR> ImgBurn

[10/25/2008|08:40] C:\Program Files\<DIR> InstallShield Installation Information

[08/20/2008|10:16] C:\Program Files\<DIR> Intel

[08/20/2008|08:28] C:\Program Files\<DIR> Internet Download Manager

[10/16/2008|03:02] C:\Program Files\<DIR> Internet Explorer

[10/27/2008|05:54] C:\Program Files\<DIR> iPod

[10/25/2008|08:36] C:\Program Files\<DIR> Irrational Games

[10/27/2008|05:55] C:\Program Files\<DIR> iTunes

[09/02/2008|03:15] C:\Program Files\<DIR> IVMLAB

[10/31/2008|11:21] C:\Program Files\<DIR> Java

[09/11/2008|06:28] C:\Program Files\<DIR> KCeasy

[08/22/2008|02:26] C:\Program Files\<DIR> K-Lite Codec Pack

[08/25/2008|10:01] C:\Program Files\<DIR> Kodak

[09/09/2008|02:15] C:\Program Files\<DIR> Koei

[10/27/2008|12:21] C:\Program Files\<DIR> KONAMI

[09/08/2008|07:49] C:\Program Files\<DIR> Lionhead Studios

[09/02/2008|03:52] C:\Program Files\<DIR> MagicISO

[10/30/2008|11:04] C:\Program Files\<DIR> Malwarebytes' Anti-Malware

[09/26/2008|03:00] C:\Program Files\<DIR> Messenger

[08/20/2008|10:03] C:\Program Files\<DIR> microsoft frontpage

[08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Office

[08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Visual Studio

[08/28/2008|06:07] C:\Program Files\<DIR> Microsoft Visual Studio 8

[08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Works

[08/28/2008|06:08] C:\Program Files\<DIR> Microsoft.NET

[09/28/2008|12:04] C:\Program Files\<DIR> mIRC

[09/25/2008|03:12] C:\Program Files\<DIR> Movie Maker

[11/01/2008|11:21] C:\Program Files\<DIR> Mozilla Firefox

[08/28/2008|06:09] C:\Program Files\<DIR> MSBuild

[08/20/2008|09:59] C:\Program Files\<DIR> MSN

[08/20/2008|10:00] C:\Program Files\<DIR> MSN Gaming Zone

[09/25/2008|03:10] C:\Program Files\<DIR> NetMeeting

[09/17/2008|04:22] C:\Program Files\<DIR> Night Watch

[08/20/2008|10:00] C:\Program Files\<DIR> Online Services

[09/25/2008|03:10] C:\Program Files\<DIR> Outlook Express

[09/13/2008|09:50] C:\Program Files\<DIR> P2P_Energy

[11/01/2008|04:39] C:\Program Files\<DIR> Panda Security

[10/05/2008|10:29] C:\Program Files\<DIR> PPLive

[11/01/2008|04:33] C:\Program Files\<DIR> PPLiveVA

[10/12/2008|03:50] C:\Program Files\<DIR> PPStream

[09/11/2008|12:12] C:\Program Files\<DIR> QuickTime

[08/22/2008|10:03] C:\Program Files\<DIR> Real

[09/05/2008|04:20] C:\Program Files\<DIR> Reality Pump

[08/20/2008|10:17] C:\Program Files\<DIR> Realtek

[09/28/2008|08:16] C:\Program Files\<DIR> SatelliteTVforPC

[11/01/2008|03:27] C:\Program Files\<DIR> Spybot - Search & Destroy

[10/31/2008|11:24] C:\Program Files\<DIR> SUPERAntiSpyware

[09/11/2008|08:39] C:\Program Files\<DIR> The Adventure Company

[10/01/2008|09:58] C:\Program Files\<DIR> The Witcher

[09/23/2008|11:41] C:\Program Files\<DIR> Thunder Network

[11/01/2008|05:44] C:\Program Files\<DIR> Trend Micro

[09/28/2008|08:17] C:\Program Files\<DIR> TVAnts

[10/12/2008|03:52] C:\Program Files\<DIR> TVUPlayer

[09/23/2008|04:09] C:\Program Files\<DIR> Ubisoft

[08/20/2008|10:09] C:\Program Files\<DIR> Uninstall Information

[10/01/2008|12:20] C:\Program Files\<DIR> Universal Extractor

[10/03/2008|05:10] C:\Program Files\<DIR> USB Vibration

[08/20/2008|10:29] C:\Program Files\<DIR> uTorrent

[09/24/2008|03:46] C:\Program Files\<DIR> VideoLAN

[11/01/2008|11:21] C:\Program Files\<DIR> Warcraft III

[09/11/2008|10:15] C:\Program Files\<DIR> Windows Live

[09/11/2008|10:18] C:\Program Files\<DIR> Windows Live Safety Center

[10/09/2008|06:41] C:\Program Files\<DIR> Windows Media Player

[09/25/2008|03:10] C:\Program Files\<DIR> Windows NT

[08/20/2008|10:02] C:\Program Files\<DIR> WindowsUpdate

[08/20/2008|10:36] C:\Program Files\<DIR> WinRAR

[08/20/2008|10:03] C:\Program Files\<DIR> xerox

[10/30/2008|09:46] C:\Program Files\<DIR> Yahoo!

[09/08/2008|10:30] C:\Program Files\<DIR> ZincPlay

--------------------\\ Listing Folders in C:\Program Files\Common Files

[10/18/2008|12:21] C:\Program Files\Common Files\<DIR> Adobe

[10/18/2008|12:22] C:\Program Files\Common Files\<DIR> Adobe AIR

[09/11/2008|12:11] C:\Program Files\Common Files\<DIR> Apple

[08/28/2008|06:09] C:\Program Files\Common Files\<DIR> DESIGNER

[09/22/2008|01:44] C:\Program Files\Common Files\<DIR> INCA Shared

[10/25/2008|08:36] C:\Program Files\Common Files\<DIR> InstallShield

[08/21/2008|11:53] C:\Program Files\Common Files\<DIR> Java

[09/11/2008|10:15] C:\Program Files\Common Files\<DIR> Microsoft Shared

[08/20/2008|10:01] C:\Program Files\Common Files\<DIR> MSSoap

[08/20/2008|01:22] C:\Program Files\Common Files\<DIR> ODBC

[08/22/2008|10:03] C:\Program Files\Common Files\<DIR> Real

[08/20/2008|10:01] C:\Program Files\Common Files\<DIR> Services

[08/20/2008|01:22] C:\Program Files\Common Files\<DIR> SpeechEngines

[09/25/2008|03:10] C:\Program Files\Common Files\<DIR> System

[09/23/2008|11:41] C:\Program Files\Common Files\<DIR> Thunder Network

[09/11/2008|10:15] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller

[10/31/2008|11:23] C:\Program Files\Common Files\<DIR> Wise Installation Wizard

[08/22/2008|10:03] C:\Program Files\Common Files\<DIR> xing shared

--------------------\\ Process

( 37 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-01 23:56:46

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

--------------------\\ Searching for other infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent

[F:41][D:14]-> C:\DOCUME~1\Zj\LOCALS~1\Temp

[F:21][D:0]-> C:\DOCUME~1\Zj\Cookies

[F:432][D:4]-> C:\DOCUME~1\Zj\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Sat 11/01/2008|23:25 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - Sat 11/01/2008|23:49 - Option : [1]

3 - "C:\Lop SD\LopR_3.txt" - Sat 11/01/2008|23:53 - Option : [1]

4 - "C:\Lop SD\LopR_4.txt" - Sat 11/01/2008|23:57 - Option : [1]

--------------------\\ Scan completed at 23:57:08

Link to post
Share on other sites

You got infected because you downloaded cracks

Please download the OTMoveIt3 by OldTimer or from here.

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    :Processesexplorer.exe
    :Services
    :Reg
    :FilesC:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrentC:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent
    :Commands[purity][emptytemp][start explorer][Reboot]


  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)
Link to post
Share on other sites

You got infected because you downloaded cracks

Please download the OTMoveIt3 by OldTimer or from here.

  • Save it to your desktop.

  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes

    explorer.exe

    :Services

    :Reg

    :Files

    C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent

    C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent

    C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent

    C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent

    C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent

    C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent

    :Commands

    [purity]

    [emptytemp]

    [start explorer]

    [Reboot]

  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.

  • Click the red Moveit! button.

  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.

  • Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.

  • Double click on RSIT.exe to run RSIT.

  • Click Continue at the disclaimer screen.

  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Thx for the fast reply,

here's the log

OTMoveIt3

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== SERVICES/DRIVERS ==========

========== REGISTRY ==========

========== FILES ==========

C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent moved successfully.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_J0laS9E3C85KF9FWiY4Y scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

Local Service Temporary Internet Files folder emptied.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_754.dat scheduled to be deleted on reboot.

Windows Temp folder emptied.

Java cache emptied.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl scheduled to be deleted on reboot.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11022008_000751

Files moved on Reboot...

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe moved successfully.

DllUnregisterServer procedure not found in C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll NOT unregistered.

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll moved successfully.

File C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_J0laS9E3C85KF9FWiY4Y not found!

File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

File C:\WINDOWS\temp\Perflib_Perfdata_754.dat not found!

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl moved successfully.

RSIT log.txt

Logfile of random's system information tool 1.04 (written by random/random)

Run by Zj at 2008-11-02 00:13:05

Microsoft Windows XP Professional Service Pack 3

System drive C: has 33 GB (11%) free of 305 GB

Total RAM: 2047 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:13:07 AM, on 11/2/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\Flashy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PPStream\ppsap.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Zj\Desktop\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\Zj.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)

O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Program Files\PPLiveVA\DownloaderManager.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe

O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Flashy Bot] C:\WINDOWS\system32\Flashy.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe

O4 - HKCU\..\Run: [PPLiveVA] C:\Program Files\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [iDMan] C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe /onboot

O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: systemID.pif = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Download all links with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetAll.htm

O8 - Extra context menu item: Download FLV video content with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetVL.htm

O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000

O8 - Extra context menu item: Download with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEExt.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button:

Link to post
Share on other sites

Hello

Plug your USB key in for this

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKLM\..\Run: [Flashy Bot] C:\WINDOWS\system32\Flashy.exe

O4 - Startup: systemID.pif = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Please download the OTMoveIt3 by OldTimer or from here.

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    :Processesexplorer.exe
    :Services
    :Reg[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]"DisableRegistryTools"=-"DisableTaskMgr"=-[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cd9d87c-a59e-11dd-ba28-0019dbb54ec5}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d21561a4-6eab-11dd-b9b5-0019dbb54ec5}]
    :FilesC:\WINDOWS\system32\Flashy.exeG:\Winnie.exeC:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif
    :Commands[purity][emptytemp][start explorer][Reboot]


  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Also post a new Rsit log

Link to post
Share on other sites

Hello

Plug your USB key in for this

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKLM\..\Run: [Flashy Bot] C:\WINDOWS\system32\Flashy.exe

O4 - Startup: systemID.pif = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Please download the OTMoveIt3 by OldTimer or from here.

  • Save it to your desktop.

  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes

    explorer.exe

    :Services

    :Reg

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

    "DisableRegistryTools"=-

    "DisableTaskMgr"=-

    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cd9d87c-a59e-11dd-ba28-0019dbb54ec5}]

    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d21561a4-6eab-11dd-b9b5-0019dbb54ec5}]

    :Files

    C:\WINDOWS\system32\Flashy.exe

    G:\Winnie.exe

    C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif

    :Commands

    [purity]

    [emptytemp]

    [start explorer]

    [Reboot]

  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.

  • Click the red Moveit! button.

  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.

  • Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Also post a new Rsit log

Hi again,

the usb which hav flashy its actually a tumbdrive from my sis, i need to collect it from her b4 i can continue, i will post back asap , pls be patience with me, if there is other way to get rid of it without the tumbdrive, pls let me know, thx a lot

Link to post
Share on other sites

You can go ahead without the thumbdrive, its not essential

OTMoveIt3

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== SERVICES/DRIVERS ==========

========== REGISTRY ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableRegistryTools deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr deleted successfully.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cd9d87c-a59e-11dd-ba28-0019dbb54ec5}\\ deleted successfully.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d21561a4-6eab-11dd-b9b5-0019dbb54ec5}\\ deleted successfully.

========== FILES ==========

C:\WINDOWS\system32\Flashy.exe moved successfully.

File/Folder G:\Winnie.exe not found.

File/Folder C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif not found.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_emxFXFEI0BzIZEX15Pcn scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

Local Service Temporary Internet Files folder emptied.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_4e0.dat scheduled to be deleted on reboot.

Windows Temp folder emptied.

Java cache emptied.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl scheduled to be deleted on reboot.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

RSIT log.txt

Logfile of random's system information tool 1.04 (written by random/random)

Run by Zj at 2008-11-02 02:30:45

Microsoft Windows XP Professional Service Pack 3

System drive C: has 33 GB (11%) free of 305 GB

Total RAM: 2047 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:30:46 AM, on 11/2/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PPStream\ppsap.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Zj\Desktop\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\Zj.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)

O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Program Files\PPLiveVA\DownloaderManager.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe

O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe

O4 - HKCU\..\Run: [PPLiveVA] C:\Program Files\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [iDMan] C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe /onboot

O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O8 - Extra context menu item: Download all links with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetAll.htm

O8 - Extra context menu item: Download FLV video content with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetVL.htm

O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000

O8 - Extra context menu item: Download with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEExt.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button:

Link to post
Share on other sites

Hi onlilife, please make your sister aware that here flashdrive is infected and should not be used until she gets it cleaned.

Pardon my interruption Rorschach112, I didn't see where you had advised this.

Hello jean, will let my sis know asap, n thx for mentioning.

Link to post
Share on other sites

Its fine to run the flash drive onlilife, you don't need to worry about it infecting your machine as we have already removed the infection that was responsible. So feel free to use it

Nearly done now

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Go to Kaspersky website and perform an online antivirus scan.

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases

[*]Click on My Computer under Scan.

[*]Once the scan is complete, it will display the results. Click on View Scan Report.

[*]You will see a list of infected items there. Click on Save Report As....

[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

Link to post
Share on other sites

Its fine to run the flash drive onlilife, you don't need to worry about it infecting your machine as we have already removed the infection that was responsible. So feel free to use it

Nearly done now

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

  • If an update is found, it will download and install the latest version.

  • Once the program has loaded, select "Perform Quick Scan", then click Scan.

  • The scan may take some time to finish,so please be patient.

  • When the scan is complete, click OK, then Show Results to view the results.

  • Make sure that everything is checked, and click Remove Selected.

  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)

  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Go to Kaspersky website and perform an online antivirus scan.

  1. Read through the requirements and privacy statement and click on Accept button.

  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.

  3. When the downloads have finished, click on Settings.

  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs

      Archives

      Mail databases

[*]Click on My Computer under Scan.

[*]Once the scan is complete, it will display the results. Click on View Scan Report.

[*]You will see a list of infected items there. Click on Save Report As....

[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

Hello again, i will post the mbam log first, as i have trouble with kaspersky scanner, been trying the whole day and always got stuck at 40%.

MBAM

Malwarebytes' Anti-Malware 1.30

Database version: 1358

Windows 5.1.2600 Service Pack 3

11/3/2008 8:21:36 PM

mbam-log-2008-11-03 (20-21-36).txt

Scan type: Quick Scan

Objects scanned: 50417

Time elapsed: 3 minute(s), 9 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.