Task manager

onlilife · November 1, 2008

Hi to everyone out there, i hav a problem with task manger, whenever i press Clt, alt, delete, instead of the task manager, windows pop up a message saying

task manager have been disable by the administrator, also when try to run regedit, the same message came out. if anyone knows hw to solve this pls help me out, thx in advance.

MBAM Log -

-----------------------------------

Malwarebytes' Anti-Malware 1.30

Database version: 1349

Windows 5.1.2600 Service Pack 3

11/1/2008 6:15:03 PM

mbam-log-2008-11-01 (18-15-03).txt

Scan type: Full Scan (C:\|)

Objects scanned: 123766

Time elapsed: 28 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

----------------------------------

Panda scan

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-11-01 17:42:36

PROTECTIONS: 0

MALWARE: 9

SUSPECTS: 1

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinDisableri1.zip

00055170 mIRC/Gen Virus/Worm No 0 Yes No C:\Program Files\ZincPlay\Zion\mirc.ini

00055170 mIRC/Gen Virus/Worm No 0 Yes No C:\Program Files\ZincPlay\Zion\defaults\mirc.ini

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Zj\Cookies\zj@atdmt[1].txt

00172825 Joke/Stress Jokes No 0 Yes No C:\Documents and Settings\Zj\Desktop\Mass Folder\Desktop Pet\stress reducers.exe

00249874 application/alfacleaner HackTools No 0 Yes No c:\documents and settings\zj\application data\skinux

00366659 Trj/Flashy.B Virus/Trojan Yes 1 Yes No C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif

00366659 Trj/Flashy.B Virus/Trojan No 0 Yes No c:\windows\system32\flashy.exe

00366659 Trj/Flashy.B Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0019276.exe

00437348 Trj/Multidropper.ROJ Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][keygen.exe]

03939461 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][serial.exe]

03955213 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][install.exe]

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location

;===============================================================================

================================================================================

=

===================

No C:\Program Files\ZincPlay\Zion\mirc.exe

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

HiJack This Scan

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:44:30 PM, on 11/1/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PPStream\ppsap.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)

O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Program Files\PPLiveVA\DownloaderManager.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe

O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Flashy Bot] C:\WINDOWS\system32\Flashy.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe

O4 - HKCU\..\Run: [PPLiveVA] C:\Program Files\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [iDMan] C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe /onboot

O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: systemID.pif = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Download all links with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetAll.htm

O8 - Extra context menu item: Download FLV video content with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetVL.htm

O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000

O8 - Extra context menu item: Download with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEExt.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button:

Rorschach112 · November 1, 2008

Hello

Disable resident protections (Antivirus...); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe

Choose the language, then choose Option 1 (Search)

Wait till the end of the scan

Post the log which is created: (%SystemDrive%\lopR.txt)

onlilife · November 1, 2008

Hello
Disable resident protections (Antivirus...); you'll re-enable them after the scan
Download Lop S&D < here
Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

Hi, again

here's the log

--------------------\\ Lop S&D 4.2.4-9b XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Intel® Core2 Duo CPU E6750 @ 2.66GHz )

BIOS : Default System BIOS

USER : Zj ( Administrator )

BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:298 Go (Free:29 Go)

D:\ (CD or DVD)

E:\ (CD or DVD)

F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|04:15 )

Option : [1] ( Sat 11/01/2008|23:56 )

--------------------\\ Listing folders in APPLIC~1

[10/25/2008|08:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> {0691F710-1ECA-4B5A-9727-25554F1BFDC6}

[10/27/2008|05:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> {3276BE95_AF08_429F_A64F_CA64CB79BCF6}

[10/18/2008|12:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe

[08/21/2008|02:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple

[08/21/2008|02:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer

[09/26/2008|11:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Creative

[09/30/2008|10:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> DAEMON Tools Pro

[09/27/2008|07:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Jlcm

[08/25/2008|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Kodak

[10/16/2008|10:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> KONAMI

[08/20/2008|10:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes

[09/11/2008|10:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft

[10/16/2008|03:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft Help

[09/29/2008|01:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Naked Brothers Band

[10/01/2008|04:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLive

[10/12/2008|08:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLiveVA

[11/01/2008|04:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLiveVAPPLiveVAShareFlv

[11/01/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy

[10/31/2008|11:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SUPERAntiSpyware.com

[09/23/2008|11:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Thunder Network

[10/31/2008|02:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> thunder_vod_cache

[10/12/2008|03:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TVU Networks

[08/24/2008|02:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage

[09/11/2008|10:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller

[10/30/2008|10:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Yahoo! Companion

[08/20/2008|10:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

[08/20/2008|10:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft

[08/20/2008|10:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

[10/18/2008|12:22] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Adobe

[08/22/2008|02:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Apple Computer

[08/22/2008|12:10] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Bearshare Premium P2P

[09/11/2008|02:14] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Carnival Software

[09/26/2008|11:00] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Creative

[08/20/2008|11:11] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DAEMON Tools

[09/30/2008|10:07] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DAEMON Tools Pro

[11/01/2008|04:32] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DMCache

[09/23/2008|04:26] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Gearbox Software

[09/25/2008|03:19] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Hamachi

[09/28/2008|07:13] C:\DOCUME~1\Zj\APPLIC~1\<DIR> HTML Executable

[08/20/2008|10:09] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Identities

[09/17/2008|01:29] C:\DOCUME~1\Zj\APPLIC~1\<DIR> IDM

[08/25/2008|01:22] C:\DOCUME~1\Zj\APPLIC~1\<DIR> ImgBurn

[10/02/2008|03:48] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Leadertech

[08/20/2008|08:39] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Macromedia

[08/20/2008|10:41] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Malwarebytes

[08/22/2008|02:28] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Media Player Classic

[09/22/2008|01:42] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Microsoft

[09/28/2008|12:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> mIRC

[08/20/2008|10:27] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Mozilla

[09/24/2008|03:31] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPLive

[09/27/2008|08:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPLiveVA

[10/02/2008|03:16] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPStream

[08/22/2008|10:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Real

[08/20/2008|08:07] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SecuROM

[09/11/2008|06:28] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Shareaza

[08/24/2008|05:45] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Skinux

[09/11/2008|06:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SPORE

[09/17/2008|01:34] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Sun

[10/31/2008|11:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SUPERAntiSpyware.com

[08/20/2008|08:30] C:\DOCUME~1\Zj\APPLIC~1\<DIR> TmpRecentIcons

[09/27/2008|08:19] C:\DOCUME~1\Zj\APPLIC~1\<DIR> TVU Networks

[11/01/2008|11:52] C:\DOCUME~1\Zj\APPLIC~1\<DIR> uTorrent

[09/24/2008|03:48] C:\DOCUME~1\Zj\APPLIC~1\<DIR> vlc

[08/20/2008|10:36] C:\DOCUME~1\Zj\APPLIC~1\<DIR> WinRAR

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[10/27/2008 05:30 PM][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[11/01/2008 04:13 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT

[08/24/2001 04:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[10/08/2008|11:02] C:\Program Files\<DIR> 7-Zip

[10/14/2008|11:42] C:\Program Files\<DIR> Activision

[10/18/2008|12:22] C:\Program Files\<DIR> Adobe

[09/21/2008|06:52] C:\Program Files\<DIR> AGEIA Technologies

[09/11/2008|06:14] C:\Program Files\<DIR> Apple Software Update

[08/22/2008|05:09] C:\Program Files\<DIR> Ares

[09/02/2008|03:16] C:\Program Files\<DIR> AviSynth 2.5

[09/28/2008|07:46] C:\Program Files\<DIR> Bonjour

[09/11/2008|02:14] C:\Program Files\<DIR> Caricature Studio Green 3.6

[08/20/2008|11:19] C:\Program Files\<DIR> CCleaner

[10/18/2008|12:22] C:\Program Files\<DIR> Common Files

[09/27/2008|03:14] C:\Program Files\<DIR> Creative

[09/30/2008|10:08] C:\Program Files\<DIR> DAEMON Tools Pro

[09/02/2008|01:13] C:\Program Files\<DIR> Devious Codeworks

[08/25/2008|01:00] C:\Program Files\<DIR> DVD Decrypter

[09/11/2008|11:13] C:\Program Files\<DIR> EA GAMES

[10/02/2008|03:38] C:\Program Files\<DIR> EA Sports

[10/25/2008|08:40] C:\Program Files\<DIR> Electronic Arts

[11/01/2008|09:01] C:\Program Files\<DIR> eMule

[09/02/2008|03:16] C:\Program Files\<DIR> eRightSoft

[09/06/2008|11:11] C:\Program Files\<DIR> Hamachi

[08/25/2008|01:05] C:\Program Files\<DIR> ImgBurn

[10/25/2008|08:40] C:\Program Files\<DIR> InstallShield Installation Information

[08/20/2008|10:16] C:\Program Files\<DIR> Intel

[08/20/2008|08:28] C:\Program Files\<DIR> Internet Download Manager

[10/16/2008|03:02] C:\Program Files\<DIR> Internet Explorer

[10/27/2008|05:54] C:\Program Files\<DIR> iPod

[10/25/2008|08:36] C:\Program Files\<DIR> Irrational Games

[10/27/2008|05:55] C:\Program Files\<DIR> iTunes

[09/02/2008|03:15] C:\Program Files\<DIR> IVMLAB

[10/31/2008|11:21] C:\Program Files\<DIR> Java

[09/11/2008|06:28] C:\Program Files\<DIR> KCeasy

[08/22/2008|02:26] C:\Program Files\<DIR> K-Lite Codec Pack

[08/25/2008|10:01] C:\Program Files\<DIR> Kodak

[09/09/2008|02:15] C:\Program Files\<DIR> Koei

[10/27/2008|12:21] C:\Program Files\<DIR> KONAMI

[09/08/2008|07:49] C:\Program Files\<DIR> Lionhead Studios

[09/02/2008|03:52] C:\Program Files\<DIR> MagicISO

[10/30/2008|11:04] C:\Program Files\<DIR> Malwarebytes' Anti-Malware

[09/26/2008|03:00] C:\Program Files\<DIR> Messenger

[08/20/2008|10:03] C:\Program Files\<DIR> microsoft frontpage

[08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Office

[08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Visual Studio

[08/28/2008|06:07] C:\Program Files\<DIR> Microsoft Visual Studio 8

[08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Works

[08/28/2008|06:08] C:\Program Files\<DIR> Microsoft.NET

[09/28/2008|12:04] C:\Program Files\<DIR> mIRC

[09/25/2008|03:12] C:\Program Files\<DIR> Movie Maker

[11/01/2008|11:21] C:\Program Files\<DIR> Mozilla Firefox

[08/28/2008|06:09] C:\Program Files\<DIR> MSBuild

[08/20/2008|09:59] C:\Program Files\<DIR> MSN

[08/20/2008|10:00] C:\Program Files\<DIR> MSN Gaming Zone

[09/25/2008|03:10] C:\Program Files\<DIR> NetMeeting

[09/17/2008|04:22] C:\Program Files\<DIR> Night Watch

[08/20/2008|10:00] C:\Program Files\<DIR> Online Services

[09/25/2008|03:10] C:\Program Files\<DIR> Outlook Express

[09/13/2008|09:50] C:\Program Files\<DIR> P2P_Energy

[11/01/2008|04:39] C:\Program Files\<DIR> Panda Security

[10/05/2008|10:29] C:\Program Files\<DIR> PPLive

[11/01/2008|04:33] C:\Program Files\<DIR> PPLiveVA

[10/12/2008|03:50] C:\Program Files\<DIR> PPStream

[09/11/2008|12:12] C:\Program Files\<DIR> QuickTime

[08/22/2008|10:03] C:\Program Files\<DIR> Real

[09/05/2008|04:20] C:\Program Files\<DIR> Reality Pump

[08/20/2008|10:17] C:\Program Files\<DIR> Realtek

[09/28/2008|08:16] C:\Program Files\<DIR> SatelliteTVforPC

[11/01/2008|03:27] C:\Program Files\<DIR> Spybot - Search & Destroy

[10/31/2008|11:24] C:\Program Files\<DIR> SUPERAntiSpyware

[09/11/2008|08:39] C:\Program Files\<DIR> The Adventure Company

[10/01/2008|09:58] C:\Program Files\<DIR> The Witcher

[09/23/2008|11:41] C:\Program Files\<DIR> Thunder Network

[11/01/2008|05:44] C:\Program Files\<DIR> Trend Micro

[09/28/2008|08:17] C:\Program Files\<DIR> TVAnts

[10/12/2008|03:52] C:\Program Files\<DIR> TVUPlayer

[09/23/2008|04:09] C:\Program Files\<DIR> Ubisoft

[08/20/2008|10:09] C:\Program Files\<DIR> Uninstall Information

[10/01/2008|12:20] C:\Program Files\<DIR> Universal Extractor

[10/03/2008|05:10] C:\Program Files\<DIR> USB Vibration

[08/20/2008|10:29] C:\Program Files\<DIR> uTorrent

[09/24/2008|03:46] C:\Program Files\<DIR> VideoLAN

[11/01/2008|11:21] C:\Program Files\<DIR> Warcraft III

[09/11/2008|10:15] C:\Program Files\<DIR> Windows Live

[09/11/2008|10:18] C:\Program Files\<DIR> Windows Live Safety Center

[10/09/2008|06:41] C:\Program Files\<DIR> Windows Media Player

[09/25/2008|03:10] C:\Program Files\<DIR> Windows NT

[08/20/2008|10:02] C:\Program Files\<DIR> WindowsUpdate

[08/20/2008|10:36] C:\Program Files\<DIR> WinRAR

[08/20/2008|10:03] C:\Program Files\<DIR> xerox

[10/30/2008|09:46] C:\Program Files\<DIR> Yahoo!

[09/08/2008|10:30] C:\Program Files\<DIR> ZincPlay

--------------------\\ Listing Folders in C:\Program Files\Common Files

[10/18/2008|12:21] C:\Program Files\Common Files\<DIR> Adobe

[10/18/2008|12:22] C:\Program Files\Common Files\<DIR> Adobe AIR

[09/11/2008|12:11] C:\Program Files\Common Files\<DIR> Apple

[08/28/2008|06:09] C:\Program Files\Common Files\<DIR> DESIGNER

[09/22/2008|01:44] C:\Program Files\Common Files\<DIR> INCA Shared

[10/25/2008|08:36] C:\Program Files\Common Files\<DIR> InstallShield

[08/21/2008|11:53] C:\Program Files\Common Files\<DIR> Java

[09/11/2008|10:15] C:\Program Files\Common Files\<DIR> Microsoft Shared

[08/20/2008|10:01] C:\Program Files\Common Files\<DIR> MSSoap

[08/20/2008|01:22] C:\Program Files\Common Files\<DIR> ODBC

[08/22/2008|10:03] C:\Program Files\Common Files\<DIR> Real

[08/20/2008|10:01] C:\Program Files\Common Files\<DIR> Services

[08/20/2008|01:22] C:\Program Files\Common Files\<DIR> SpeechEngines

[09/25/2008|03:10] C:\Program Files\Common Files\<DIR> System

[09/23/2008|11:41] C:\Program Files\Common Files\<DIR> Thunder Network

[09/11/2008|10:15] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller

[10/31/2008|11:23] C:\Program Files\Common Files\<DIR> Wise Installation Wizard

[08/22/2008|10:03] C:\Program Files\Common Files\<DIR> xing shared

--------------------\\ Process

( 37 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-01 23:56:46

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

--------------------\\ Searching for other infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent

C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent

[F:41][D:14]-> C:\DOCUME~1\Zj\LOCALS~1\Temp

[F:21][D:0]-> C:\DOCUME~1\Zj\Cookies

[F:432][D:4]-> C:\DOCUME~1\Zj\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Sat 11/01/2008|23:25 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - Sat 11/01/2008|23:49 - Option : [1]

3 - "C:\Lop SD\LopR_3.txt" - Sat 11/01/2008|23:53 - Option : [1]

4 - "C:\Lop SD\LopR_4.txt" - Sat 11/01/2008|23:57 - Option : [1]

--------------------\\ Scan completed at 23:57:08

Rorschach112 · November 1, 2008

You got infected because you downloaded cracks

Please download the OTMoveIt3 by OldTimer or from here.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processesexplorer.exe
:Services
:Reg
:FilesC:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrentC:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrentC:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent
:Commands[purity][emptytemp][start explorer][Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

onlilife · November 1, 2008

You got infected because you downloaded cracks
Please download the OTMoveIt3 by OldTimer or from here.
Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
:Processes
explorer.exe
:Services
:Reg
:Files
C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent
C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent
C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent
C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent
C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent
C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Thx for the fast reply,

here's the log

OTMoveIt3

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== SERVICES/DRIVERS ==========

========== REGISTRY ==========

========== FILES ==========

C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent moved successfully.

C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent moved successfully.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_J0laS9E3C85KF9FWiY4Y scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

Local Service Temporary Internet Files folder emptied.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_754.dat scheduled to be deleted on reboot.

Windows Temp folder emptied.

Java cache emptied.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl scheduled to be deleted on reboot.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11022008_000751

Files moved on Reboot...

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe moved successfully.

DllUnregisterServer procedure not found in C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll NOT unregistered.

C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll moved successfully.

File C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_J0laS9E3C85KF9FWiY4Y not found!

File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

File C:\WINDOWS\temp\Perflib_Perfdata_754.dat not found!

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite moved successfully.

C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl moved successfully.

RSIT log.txt

Logfile of random's system information tool 1.04 (written by random/random)

Run by Zj at 2008-11-02 00:13:05

Microsoft Windows XP Professional Service Pack 3

System drive C: has 33 GB (11%) free of 305 GB

Total RAM: 2047 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:13:07 AM, on 11/2/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\Flashy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PPStream\ppsap.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Zj\Desktop\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\Zj.exe