my friends claims that my notebook hv viruses... so can u help me check it please?thanks.. Logfile of HijackThis v1.99.1 Scan saved at 7:57:36 AM, on 8/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\tp4mon.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\HijackThis_v1.99.1.exe R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: (no name) - {397D7D63-816E-4ECF-8761-775C932C5CF1} - C:\WINDOWS\iDonate.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe thanks..
Looking over your log, it seems you don't have any evidence of a third party firewall. As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors: 1) ZoneAlarm 2) Agnitum 3) Sunbelt/Kerio 4) Comodo If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time. ========= Looking over your log, it seems you don't have any evidence of an anti-virus software. Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW: 1) Antivir PersonalEdition Classic - Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support. 2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users. 3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows. It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time. ======== Download and Run ComboFix *Download this file from either of the two below listed places : http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe *Then double click combofix.exe & follow the prompts. *When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ======== Post combofix log then...
yupz... i knew tht i dont hv any firewalls n anti-virus and i'm aware of the danger that might come in...thanks for the advice i'll start to download and install it later when i'm not in campus..because my campus put a limitation in our download bandwith..onley 2MB...yea...i mean 2MB... here is the combofix log ComboFix 07-08-04.3 - "xsky_leo" 2007-08-04 18:50:03.1 [GMT 8:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True * Created a new restore point ((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 ))))))))))))))))))))))))))))))) 2007-08-04 18:49 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-04 08:03 <DIR> d-------- C:\VundoFix Backups 2007-08-04 07:56 2,196 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-15 10:21 32,768 --a------ C:\WINDOWS\iDonate.dll 2007-07-12 18:14 <DIR> d-------- C:\Worms 3D 2007-07-12 11:34 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-07-12 11:34 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-07-12 11:31 198,656 --a------ C:\WINDOWS\system32\CNMLM8O.DLL 2007-07-12 11:31 <DIR> d--h----- C:\WINDOWS\system32\CanonIJ Uninstaller Information 2007-07-12 11:31 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ 2007-07-12 11:30 <DIR> d--h----- C:\Program Files\CanonBJ 2007-07-12 11:30 <DIR> d-------- C:\Program Files\Canon (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-02 21:19 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-08-02 12:53 10 --a--c--- C:\WINDOWS\popcinfo.dat 2007-07-13 21:39 --------- d-------- C:\Program Files\mIRC 2007-07-07 07:40 --------- d-------- C:\Program Files\Yahoo! 2007-07-07 07:39 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-06-16 10:19 --------- d-------- C:\Program Files\Phoenix Games Studio 2007-06-16 10:14 --------- d-------- C:\DOCUME~1\xsky_leo\APPLIC~1\IMVU 2007-06-14 13:45 --------- d-------- C:\Program Files\FlashGet 2007-05-07 16:24 716 --a--c--- C:\WINDOWS\eReg.dat 2007-05-05 13:31 94208 --a--c--- C:\WINDOWS\system32\MSSTKPRP.DLL 2007-05-05 13:31 397312 --a--c--- C:\WINDOWS\system32\MSRDO20.DLL 2007-05-05 13:31 204800 --a--c--- C:\WINDOWS\system32\INKED.DLL 2007-05-05 13:31 189952 --a--c--- C:\WINDOWS\system32\WISPTIS.EXE 2007-05-05 13:31 151552 --a--c--- C:\WINDOWS\system32\RDOCURS.DLL 2007-05-05 13:31 118784 --a--c--- C:\WINDOWS\system32\MSSTDFMT.DLL 2007-05-05 13:31 1146320 --a--c--- C:\WINDOWS\system32\FM20.DLL 2007-05-05 13:22 53248 --a--c--- C:\WINDOWS\system32\MFC42ENU.DLL 2007-05-05 13:22 40960 --a--c--- C:\WINDOWS\system32\VBAME.DLL 2007-05-05 13:22 32584 --a--c--- C:\WINDOWS\system32\FM20ENU.DLL 2007-05-05 13:22 15872 --a--c--- C:\WINDOWS\system32\SCP32.DLL 2007-05-05 13:14 24816 --a------ C:\WINDOWS\system32\mdimon.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{397D7D63-816E-4ECF-8761-775C932C5CF1}] 2007-07-15 10:21 32768 --a------ C:\WINDOWS\iDonate.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrackPointSrv"="tp4mon.exe" [2004-08-04 08:56 C:\WINDOWS\system32\tp4mon.exe] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 08:39] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 08:36] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 08:40] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-08 01:19] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40] "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2006-10-17 09:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-01-19 12:49] C:\Documents and Settings\xsky_leo\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon] LogonDll.dll 2004-08-08 20:19 49152 C:\WINDOWS\system32\LogonDll.dll R0 DeepFrz;DeepFrz;C:\WINDOWS\system32\drivers\DeepFrz.sys R0 sfsync04;StarForce Protection Synchronization Driver (version 4.x);C:\WINDOWS\system32\drivers\sfsync04.sys R2 SoundMAX Agent Service (default);SoundMAX Agent Service;C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe R3 E100B;Intel(R) PRO Network Connection Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys S3 EagleNT;EagleNT;\??\C:\WINDOWS\system32\drivers\EagleNT.sys S3 UIUSys;Conexant Setup API;C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS S3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP;C:\WINDOWS\system32\DRIVERS\w29n51.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4daf996b-e10f-11db-a3e6-0012f0361ed0}] AutoRun\command- F:\TrueCrypt\TrueCrypt.exe /q background /lZ /e /m rm /v "MMX.system32_x64.Filesystem.MINERVA" dismount\command- F:\TrueCrypt\TrueCrypt.exe /q /d start\command- F:\TrueCrypt\TrueCrypt.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2e71ab0-d194-11db-a3d6-000ae431e826}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Boot.exe e Open\command- Boot.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b819f1a0-2ea2-11dc-a40d-000ae431e826}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe Explore\command- Flash.10.Setup.exe Open\command- Flash.10.Setup.exe Scan for Viruses\command- F:\Scanner.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c581ca90-e896-11db-a3eb-000ae431e826}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d758c9fb-3413-11dc-a418-000ae431e826}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d758c9fc-3413-11dc-a418-000ae431e826}] AutoRun\command- G:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db7cc262-b96d-11db-a3a4-0012f0361ed0}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-04 18:52:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-04 18:53:03 --- E O F ---
Please also download Flash Disinfector by sUBs and save it to your desktop. Plug in your external disk and hold down the Shift key so it doesn't auto run. Double click on Flash_Disinfector.exe to run it. Your desktop will disappear for a while. Once the cleaning is done, click OK and your desktop will return. If it doesn't appear, press Ctrl + Shift + Esc to bring up Task Manager. Click on File > New Task (Run...). Copy and paste in explorer.exe and click OK. ======== Open notepad and copy/paste the text in the quotebox below into it: Save this as CFScript. (Check the spelling) Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. =====
ok here goes ComboFix 07-08-04.3 - "xsky_leo" 2007-08-05 7:08:59.2 [GMT 8:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True Command switches used :: C:\Documents and Settings\xsky_leo\Desktop\CFScript..txt * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\iDonate.dll ((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 ))))))))))))))))))))))))))))))) 2007-08-05 07:05 77,131 --a------ C:\Flash_Disinfector.exe 2007-08-04 19:28 3,585,414 -r-hs---- C:\AVG7DB_F.DAT 2007-08-04 18:49 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-04 08:03 <DIR> d-------- C:\VundoFix Backups 2007-08-04 07:56 2,196 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-12 18:14 <DIR> d-------- C:\Worms 3D 2007-07-12 11:34 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-07-12 11:34 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-07-12 11:31 198,656 --a------ C:\WINDOWS\system32\CNMLM8O.DLL 2007-07-12 11:31 <DIR> d--h----- C:\WINDOWS\system32\CanonIJ Uninstaller Information 2007-07-12 11:31 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ 2007-07-12 11:30 <DIR> d--h----- C:\Program Files\CanonBJ 2007-07-12 11:30 <DIR> d-------- C:\Program Files\Canon (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-02 21:19 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-08-02 12:53 10 --a--c--- C:\WINDOWS\popcinfo.dat 2007-07-13 21:39 --------- d-------- C:\Program Files\mIRC 2007-07-07 07:40 --------- d-------- C:\Program Files\Yahoo! 2007-07-07 07:39 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-06-16 10:19 --------- d-------- C:\Program Files\Phoenix Games Studio 2007-06-16 10:14 --------- d-------- C:\DOCUME~1\xsky_leo\APPLIC~1\IMVU 2007-06-14 13:45 --------- d-------- C:\Program Files\FlashGet 2007-05-07 16:24 716 --a--c--- C:\WINDOWS\eReg.dat 2007-05-05 13:31 94208 --a--c--- C:\WINDOWS\system32\MSSTKPRP.DLL 2007-05-05 13:31 397312 --a--c--- C:\WINDOWS\system32\MSRDO20.DLL 2007-05-05 13:31 204800 --a--c--- C:\WINDOWS\system32\INKED.DLL 2007-05-05 13:31 189952 --a--c--- C:\WINDOWS\system32\WISPTIS.EXE 2007-05-05 13:31 151552 --a--c--- C:\WINDOWS\system32\RDOCURS.DLL 2007-05-05 13:31 118784 --a--c--- C:\WINDOWS\system32\MSSTDFMT.DLL 2007-05-05 13:31 1146320 --a--c--- C:\WINDOWS\system32\FM20.DLL 2007-05-05 13:22 53248 --a--c--- C:\WINDOWS\system32\MFC42ENU.DLL 2007-05-05 13:22 40960 --a--c--- C:\WINDOWS\system32\VBAME.DLL 2007-05-05 13:22 32584 --a--c--- C:\WINDOWS\system32\FM20ENU.DLL 2007-05-05 13:22 15872 --a--c--- C:\WINDOWS\system32\SCP32.DLL 2007-05-05 13:14 24816 --a------ C:\WINDOWS\system32\mdimon.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrackPointSrv"="tp4mon.exe" [2004-08-04 08:56 C:\WINDOWS\system32\tp4mon.exe] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-02-07 08:39] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-02-07 08:36] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-02-07 08:40] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 12:41] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-08 01:19] "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2006-10-17 09:20] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"=D:\AVG7\Grisoft\avgw.exe /RUNONCE C:\Documents and Settings\xsky_leo\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon] LogonDll.dll 2004-08-08 20:19 49152 C:\WINDOWS\system32\LogonDll.dll R0 DeepFrz;DeepFrz;C:\WINDOWS\system32\drivers\DeepFrz.sys R0 sfsync04;StarForce Protection Synchronization Driver (version 4.x);C:\WINDOWS\system32\drivers\sfsync04.sys R2 SoundMAX Agent Service (default);SoundMAX Agent Service;C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe R3 E100B;Intel(R) PRO Network Connection Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP;C:\WINDOWS\system32\DRIVERS\w29n51.sys S3 EagleNT;EagleNT;\??\C:\WINDOWS\system32\drivers\EagleNT.sys S3 UIUSys;Conexant Setup API;C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4daf996b-e10f-11db-a3e6-0012f0361ed0}] AutoRun\command- F:\TrueCrypt\TrueCrypt.exe /q background /lZ /e /m rm /v "MMX.system32_x64.Filesystem.MINERVA" dismount\command- F:\TrueCrypt\TrueCrypt.exe /q /d start\command- F:\TrueCrypt\TrueCrypt.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2e71ab0-d194-11db-a3d6-000ae431e826}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Boot.exe e Open\command- Boot.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b819f1a0-2ea2-11dc-a40d-000ae431e826}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Flash.10.Setup.exe Explore\command- Flash.10.Setup.exe Open\command- Flash.10.Setup.exe Scan for Viruses\command- F:\Scanner.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c581ca90-e896-11db-a3eb-000ae431e826}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d758c9fb-3413-11dc-a418-000ae431e826}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d758c9fc-3413-11dc-a418-000ae431e826}] AutoRun\command- G:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db7cc262-b96d-11db-a3a4-0012f0361ed0}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-05 07:11:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-05 7:12:13 C:\ComboFix-quarantined-files.txt ... 2007-08-05 07:11 C:\ComboFix2.txt ... 2007-08-04 18:53 --- E O F --- anything else?i would appreciate if you could explain to me what happened ^^ thanks
First we'll need to backup registry: Start -> Run -> regedit -> ok. Then File -> Export. Give it a name and press Save. Save text below as fix.reg on Notepad (save it as all files (*.*)) on Desktop Code: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db7cc262-b96d-11db-a3a4-0012f0361ed0}] It should look like this -> Doubleclick fix.reg, press Yes and ok. ======== Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder. Version 7.5.0.50 ! * Install AVG Anti-Spyware by double clicking the installer. * Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked. * On the main screen under Your Computer's security. * Click on Change state next to Resident shield. It should now change to inactive. * Click on Change state next to Automatic updates. It should now change to inactive. * Next to Last Update, click on Update now. (You will need an active internet connection to perform this) * Wait until you see the Update succesfull message. * Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows. * Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes. If you are having problems with the updater, you can use this link to manually update ewido. AVG Anti-Spyware manual updates. Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. If AVG doesn't work in Safemode, please use this patchfile to make it work. Don't run just yet! Restart your computer to Safe Mode. 1. If the computer is running, shut down Windows, and then turn off the power. 2. Wait 30 seconds, and then turn the computer on. 3. Start tapping the F8 key. The Windows Advanced Options Menu will appear. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again. 4. Ensure that the Safe Mode option is selected. 5. Press Enter. The computer then begins to start in Safe Mode. 6. Login on your usual account. Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan. * Click on Scanner on the toolbar. * Click on the Settings tab. * Under How to act? * Click on Recommended Action and choose Quarantine from the popup menu. * Under How to scan? * All checkboxes should be ticked. * Under Possibly unwanted software: * All checkboxes should be ticked. * Under Reports: * Select Automatically generate report after every scan and uncheck Only if threats were found. * Under What to scan? * Select Scan every file. * Click on the Scan tab. * Click on Complete System Scan to start the scan process. * Let the program scan the machine. * When the scan has finished, follow the instructions below. IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button. * Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2) * At the bottom of the window click on the Apply all Actions button. (3) * When done, click the Save Scan Report button. (4) * Click the Save Report as button. * Save the report to your Desktop. * Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes. Reboot in Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware log.
hye there.... recently i've updated my AVG anti-virus n AVG anti-spyware... but the bad things are tht...these anti-virus keep trekking of threat name I-Worm/Luder these worms were taking on all my win32 files making all my stuffs cannot be accessed and my applications can't run.. i've put them into the vault all of them...but still my applications all gone haywire.. i lost a lot of my work that need to be submit then for the anti-spyware keep detecting worms.small.r in every booting tht i made eventhough i've quarantined it...it wont go off... and at last..all the thing that i can do is reformat... -_-"..was it my laptop condition really2 bad back there? thanks for ur help btw
Sorry about my bad english.. I don´t quite understand everything If u are not reformatterd.. I would suggest try with this program Download Dr.Web CureIt to the desktop: ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe * Doubleclick the drweb-cureit.exe file and Allow to run the express scan * This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. * Once the short scan has finished, Click Options > Change settings * Choose the "Scan"-tab, remove the mark at "Heuristic analysis". * Back at the main window, mark the drives that you want to scan. * Select all drives. A red dot shows which drives have been chosen. * Click the green arrow at the right, and the scan will start. * Click 'Yes to all' i at the right, and the scan will start. * Click 'Yes to all' if it asks if you want to cure/move the file. * When the scan has finished, look if you can click next icon next to the files found: If so, click it and then click the next icon right below and select Move incurable as you'll see in next image: at the right, and the scan will start. his will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples) * After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list * Save the report to your desktop. The report will be called DrWeb.csv * Close Dr.Web Cureit. * Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot. * After reboot, post the contents of the log from Dr.Web you saved previously in your next reply
