Hi, I have been facing the pop ups of avg7.5 anti virus scan that threat is detected but i am not able to remove the trojan horse downloader.zlob.afvc. Pl someone help me get rid of this problem as it has been a mental harassment. I have scaned with pctool anti virus as well but no traces of trojan in that scan. Pl someone help me. I dont know where from I have got this.
Hi sandneet No worries; the zlob trojan is currently relatively easy to remove with the right tools. 1. First, please reboot your computer into Safe Mode by doing the following: • Restart your computer • After pressing the power button, repeatedly tap the F8 key. • Instead of Windows loading as normal, the Advanced Options Menu should appear; • Select the first option, to run Windows in Safe Mode, then press Enter. • Choose the administrator's account. Scan with AVG, and quarantine all found threats. 2. Next, follow steps #3-6 on here: http://forums.afterdawn.com/thread_view.cfm/370698#2210178 3. Then, please download Superantispyware Free and install it. Follow the prompts and reboot if required. Launch Superantispyware Free either by running C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware... Configuring SuperAntispyware • Click on Preferences. • In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run. • Navigate to the tab Scanning Control. • Make sure only these boxes are checked: Code: Close browsers before scanning Scan for tracking cookies Terminate memory threats before quarantining Scan Alternate Data Streams Use Kernel Direct File Access (recommended) Use Kernel Direct Registry Access (recommended) Use Direct Disk Access (recommended) • Click on Close. Updating SuperAntispyware • At the main window, click on Check for Updates.... • Wait for SuperAntispyware to be fully updated. Scanning Time • Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode. • Launch SuperAntispyware. • At the main window, click on Scan your Computer.... • Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next. • Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items. • Reboot your computer. Post A Log • Launch SuperAntispyware • Click on Preferences • Navigate to the tab Statistics/Logs. • Choose the latest scan log, and the click on View Log.... • Copy and paste the contents of the log here in your next post. Best Regards
Hi Friend, Thanks for your reply. I will do the things as directed and will post the log . Thanks......
Hi, I am not able to start the machine in safe mode. After selecting the safe mode and window xp.. it doesnot start but give a lot of entris om screen and i dont understand all those. What should I do now/ Can I do the entire process in normal mode as well. Pl help.
Hi, I hope. its gone now. SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 11/06/2008 at 11:44 PM Application Version : 4.21.1004 Core Rules Database Version : 3625 Trace Rules Database Version: 1609 Scan type : Complete Scan Total Scan Time : 00:44:20 Memory items scanned : 436 Memory threats detected : 0 Registry items scanned : 5878 Registry threats detected : 60 File items scanned : 44550 File threats detected : 69 Trojan.FakeAlert-IEBT HKLM\Software\Classes\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}#www HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}\InprocServer32 HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}\InprocServer32#ThreadingModel C:\PROGRAM FILES\APPLICATIONS\IEBT.DLL HKLM\Software\Classes\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\Implemented Categories HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\Implemented Categories\{00021493-0000-0000-C000-000000000046} HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\InprocServer32 HKCR\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}\InprocServer32#ThreadingModel C:\PROGRAM FILES\APPLICATIONS\IEBR.DLL HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} HKLM\Software\Microsoft\Internet Explorer\Toolbar#{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} HKCR\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} Adware.E404 Helper/Variant-AM HKLM\Software\Classes\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7} HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7} HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7} HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\InprocServer32 HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\InprocServer32#ThreadingModel HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\ProgID HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\Programmable HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\TypeLib HKCR\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}\VersionIndependentProgID HKCR\z444.z444mgr.1 HKCR\z444.z444mgr.1\CLSID HKCR\z444.z444mgr HKCR\z444.z444mgr\CLSID HKCR\z444.z444mgr\CurVer HKCR\TypeLib\{E63648F7-3933-440E-AAAA-A8584DD7B7EB} C:\WINDOWS\SYSTEM32\512686\512686.DLL HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51B15F5A-E98B-4658-B9CB-9307B74773A7} C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP46\A0016085.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP53\A0017085.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP55\A0017122.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP56\A0017135.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017152.DLL Adware.Tracking Cookie C:\Documents and Settings\Lenovo\Cookies\lenovo@advertising[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@ad.yieldmanager[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@enhance[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@adtech[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@personalantispy[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@avgtechnologies.112.2o7[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@2o7[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@cts.metricsdirect[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@ads.bleepingcomputer[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@microsoftwindows.112.2o7[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@doubleclick[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@adtrafficstats[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@virusresponse2009[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@1071670925[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@revsci[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@adrevolver[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@clickbank[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@richmedia.yahoo[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@adopt.specificclick[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@atdmt[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@realmedia[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@tribalfusion[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@zedo[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@media.adrevolver[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@casalemedia[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@fastclick[2].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@scan.antispyware-free-scanner[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@mywebsearch[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@yadro[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@msnportal.112.2o7[1].txt C:\Documents and Settings\Lenovo\Cookies\lenovo@burstnet[2].txt Adware.MyWebSearch/FunWebProducts HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}\TreatAs HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E} HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0 HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0 HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0\win32 HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\FLAGS HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\HELPDIR HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC} HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32 HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib#Version HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF} HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32 HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib#Version HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid32 HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\TypeLib HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\TypeLib#Version C:\Program Files\FunWebProducts\Shared\00494727.dat C:\Program Files\FunWebProducts\Shared C:\Program Files\FunWebProducts Trojan.Media-Codec HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#DisplayName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#UninstallString HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#InstDate Adware.E404 Helper/Hij HKCR\CLSID\e405.e405mgr HKCR\CLSID\e405.e405mgr#UserId Adware.180solutions/Seekmo/Zango C:\DOCUMENTS AND SETTINGS\LENOVO\MY DOCUMENTS\MY PICTURES\MONU PIC\SETUP.EXE C:\RECYCLER\S-1-5-21-1757981266-583907252-839522115-1003\DC20.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013556.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013551.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013552.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013553.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013554.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013555.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013558.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013560.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013561.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013562.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013563.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013564.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013565.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013566.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013567.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013568.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013578.DLL Rogue.VirusResponseLab2009 C:\DOWNLOADS\SOFTWARE\VIRLAB_INSTALL.EXE C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP41\A0013533.EXE C:\WINDOWS\Prefetch\VIRLAB_INSTALL.EXE-21751DCD.pf Trojan.Dropper/Gen-PHP C:\RECYCLER\S-1-5-21-1757981266-583907252-839522115-1003\DC23.PHP C:\RECYCLER\S-1-5-21-1757981266-583907252-839522115-1003\DC24.PHP Adware.E404 Helper/Dropper C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017141.EXE Trojan.Dropper/Gen C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017142.DLL Trojan.Unclassified-Packed/Suspicious C:\SYSTEM VOLUME INFORMATION\_RESTORE{C1A89A7C-9BCB-479B-9E36-F9A861B67297}\RP57\A0017143.DLL
Hey sandneet 1. Now, please download ComboFix. With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. • Run Combo-Fix.exe and follow the prompts. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. • Wait for the scan to be completed. • If it requires a reboot, please do it. • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt) Do not click on the ComoboFix window, as it may cause it to stall. 2. Please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file. Rename HijackThis(.exe) to scanner(.exe). Next, run scanner(.exe). A window will pop up. • Click on the button which says Main Menu, then Do a system scan and save a logfile. • Please wait for the scan to be completed. • After the scan has completed, a text window will pop up. Please post the contents of this window here. This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved. NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer. 3. Tell me what problems you have left. Best Regards
Hi, Pl find the logs as directed... ComboFix 08-11-06.01 - Lenovo 2008-11-07 22:29:02.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.580 [GMT 5.5:30] Running from: c:\documents and settings\Lenovo\Desktop\Combo-Fix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Lenovo\My Documents\My Music\My Music.url c:\documents and settings\Lenovo\My Documents\My Pictures\My Pictures.url c:\documents and settings\Lenovo\My Documents\My Videos\My Video.url c:\windows\IE4 Error Log.txt c:\windows\system32\28463 c:\windows\system32\28463\svchost.001 c:\windows\system32\28463\svchost.002 c:\windows\system32\setup.ini . ((((((((((((((((((((((((( Files Created from 2008-10-07 to 2008-11-07 ))))))))))))))))))))))))))))))) . 2008-11-07 00:32 . 2008-11-07 00:32 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-07 00:09 . 2008-11-07 21:58 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-07 00:09 . 2008-11-07 00:09 <DIR> d-------- c:\program files\AVG 2008-11-07 00:09 . 2008-11-07 00:11 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\AVGTOOLBAR 2008-11-07 00:09 . 2008-11-07 00:09 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-07 00:09 . 2008-11-07 00:09 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-07 00:09 . 2008-11-07 00:09 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-11-07 00:09 . 2008-11-07 00:09 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-11-06 22:52 . 2008-11-06 22:52 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-06 22:52 . 2008-11-06 22:52 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\SUPERAntiSpyware.com 2008-11-06 22:52 . 2008-11-06 22:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-06 22:51 . 2008-11-06 22:51 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-06 22:48 . 2008-11-06 22:48 3,224 --a------ c:\windows\system32\tmp.reg 2008-11-05 21:26 . 2008-11-05 21:39 <DIR> d-------- c:\windows\system32\CatRoot_bak 2008-11-04 23:52 . 2008-11-04 23:58 <DIR> d-------- c:\program files\registry cleanr software 2008-11-04 23:45 . 2008-11-04 23:45 6,637,592 --a------ c:\program files\SUPERAntiSpyware.exe 2008-11-04 23:27 . 2008-11-05 00:37 <DIR> d-------- c:\program files\AVG 8 2008-11-04 22:54 . 2008-11-04 22:54 <DIR> d-------- c:\program files\MSXML 4.0 2008-11-03 21:18 . 2008-11-03 21:18 <DIR> d--h----- c:\windows\system32\GroupPolicy 2008-11-03 00:29 . 2008-11-03 00:29 7,507,296 --a------ c:\program files\registrycleaner software.exe 2008-11-03 00:21 . 2008-08-14 15:30 2,180,352 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-03 00:21 . 2008-08-14 15:28 2,136,064 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-03 00:21 . 2008-08-14 14:52 2,057,728 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-03 00:21 . 2008-08-14 14:52 2,015,744 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-02 23:31 . 2008-11-02 23:31 <DIR> d-------- c:\program files\Common Files\PC Tools 2008-11-02 22:50 . 2008-11-05 00:38 <DIR> d--h----- c:\windows\$hf_mig$ 2008-11-02 01:56 . 2008-11-02 01:56 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\Sony 2008-11-02 01:56 . 2008-11-02 01:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony 2008-11-02 01:46 . 2008-11-06 22:49 <DIR> d-------- c:\windows\system32\512686 2008-11-02 01:46 . 2008-11-07 00:06 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP 2008-10-26 23:51 . 2007-11-01 11:15 862,922 --a------ c:\windows\system32\drivers\btkrnl.sys 2008-10-26 23:51 . 2007-11-01 11:15 106,557 --a------ c:\windows\system32\btw_ci.dll 2008-10-26 23:35 . 2008-10-26 23:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters 2008-10-23 23:55 . 2008-10-24 00:15 70,231,936 --ah----- c:\program files\62bl05ww.exe 2008-10-12 20:18 . 2007-04-19 07:20 198,144 --------- c:\windows\system32\_psisdecd.dll 2008-10-12 14:36 . 2008-10-12 14:36 <DIR> d-------- c:\documents and settings\Lenovo\Application Data\Pingotron.com 2008-10-12 14:32 . 2008-10-12 14:32 <DIR> d-------- c:\program files\Internet RadioFan 2008-10-12 14:30 . 2008-10-12 14:31 855,508 --a------ c:\program files\irf.zip 2008-10-12 12:27 . 2008-10-30 23:57 <DIR> d-------- C:\Downloads 2008-10-12 11:04 . 2008-11-03 00:21 <DIR> d-------- c:\program files\Free Download Manager 2008-10-12 10:51 . 2008-10-12 10:51 6,518,873 --a------ c:\program files\fdminst3.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-02 17:10 --------- d-----w c:\program files\SoundTells 2008-11-01 20:27 --------- d-----w c:\program files\Sony Ericsson 2008-10-26 18:21 --------- d-----w c:\program files\Lenovo 2008-10-26 18:19 --------- d-----w c:\program files\Yahoo! 2008-10-26 18:19 --------- d-----w c:\documents and settings\Lenovo\Application Data\Yahoo! 2008-10-26 18:06 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-12 14:48 --------- d-----w c:\documents and settings\Lenovo\Application Data\CyberLink 2008-10-12 14:48 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink 2008-10-12 14:45 --------- d-----w c:\program files\Google 2008-10-05 17:16 19,684,396 ----a-w c:\program files\marioforever.zip 2008-10-05 11:30 --------- d-----w c:\program files\Counter Strike Mega Edition setup 2008-10-05 07:12 --------- d-----w c:\program files\WoCa_1_3_2 2008-10-03 12:56 --------- d-----w c:\program files\GameHouse 2008-09-28 16:40 --------- d-----w c:\program files\Real 2008-09-28 16:40 --------- d-----w c:\program files\Common Files\xing shared 2008-09-28 16:40 --------- d-----w c:\program files\Common Files\Real 2008-09-28 16:26 353,840 ----a-w c:\program files\RealPlayer11GOLD.exe 2008-09-28 16:01 --------- d-----w c:\documents and settings\Lenovo\Application Data\MSNInstaller 2008-09-23 17:39 --------- d-----w c:\program files\WordWeb 2008-09-23 17:34 546,955 ----a-w c:\program files\ProjectWeightLoss[1].com_Calculator_v2.0.zip 2008-09-23 17:33 1,025,017 ----a-w c:\program files\woca.exe 2008-09-23 17:30 445,381 ----a-w c:\program files\CycleCalcPCSetupTrial.exe 2008-09-23 17:27 387,041 ----a-w c:\program files\FMDv1.exe 2008-09-23 17:26 7,794,368 ----a-w c:\program files\wordweb5.exe 2008-09-21 05:05 --------- d-----w c:\program files\Winamp 2008-09-20 17:46 1,416,944 ----a-w c:\program files\WM9Codecs.exe 2008-09-19 17:34 --------- d-----w c:\program files\PDFCreator 2008-09-19 17:33 253,116 ----a-w c:\windows\PDFCreator_Toolbar_Uninstaller_5312.exe 2008-09-19 17:33 14,290 ----a-w c:\program files\settings.dat 2008-09-19 17:33 --------- d-----w c:\program files\PDFCreator Toolbar 2008-09-19 17:30 860,391 ----a-w c:\program files\7z457.exe 2008-09-19 17:30 --------- d-----w c:\program files\7-Zip 2008-09-19 17:29 15,895,117 ----a-w c:\program files\PDFCreator-0_9_5_setup.exe 2008-09-19 17:10 1,282,048 ----a-w c:\program files\cah.exe 2008-09-18 17:49 --------- d-----w c:\documents and settings\All Users\Application Data\WinZipSE 2008-09-16 17:51 --------- d-----w c:\documents and settings\All Users\Application Data\VeriFace 2008-09-16 17:17 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-14 08:32 --------- d-----w c:\documents and settings\Lenovo\Application Data\Apple Computer 2008-09-14 08:22 --------- d-----w c:\program files\QuickTime 2008-09-14 08:21 --------- d-----w c:\program files\Apple Software Update 2008-09-14 08:21 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer 2008-09-14 08:21 --------- d-----w c:\documents and settings\All Users\Application Data\Apple 2008-09-14 08:09 --------- d-----w c:\program files\Avanquest update 2008-09-14 08:09 --------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software 2008-09-14 08:08 --------- d-----w c:\documents and settings\All Users\Application Data\Sony Ericsson 2008-09-06 15:00 94,208 ----a-w c:\windows\system32\ScrUnZip.dll 2008-08-29 03:10 86,016 ----a-w c:\windows\system32\VideoOp.dll 2008-08-29 03:10 61,440 ----a-w c:\windows\system32\Momo.dll 2008-08-29 03:10 589,824 ----a-w c:\windows\system32\PicNotify.dll 2008-08-29 03:10 5,632 ----a-w c:\windows\system32\biologon.dll 2008-08-29 03:10 491,520 ----a-w c:\windows\system32\picn.dll 2008-08-29 03:10 491,520 ----a-w c:\windows\system32\MainOp.dll 2008-08-29 03:10 49,152 ----a-w c:\windows\system32\DevFilt.dll 2008-08-29 03:10 45,056 ----a-w c:\windows\system32\ApBlend.dll 2008-08-29 03:10 208,896 ----a-w c:\windows\system32\Image.dll 2008-08-29 03:10 1,314,816 ----a-w c:\windows\system32\ImageReog.dll 2008-08-29 03:04 89,088 ----a-w c:\windows\Atl71.dll 2008-08-29 03:04 626,688 ----a-w c:\windows\msvcr80.dll 2008-08-29 03:04 57,344 ----a-w c:\windows\AsfHelper.dll 2008-08-29 03:04 339,968 ----a-w c:\windows\VdoEct.dll 2008-08-29 03:04 241,664 ----a-w c:\windows\EasyCapSrcSaver.scr 2008-08-29 03:04 22,528 ----a-w c:\windows\ScrSav.dll 2008-08-29 03:04 2,222,800 ----a-w c:\windows\d3dx9_24.dll 2008-08-29 03:04 1,060,864 ----a-w c:\windows\MFC71.dll 2008-08-28 16:37 129,536 ----a-w c:\windows\system32\IJL15.dll 2008-08-25 14:40 499,712 ----a-w c:\windows\system32\msvcp71.dll 2008-08-25 14:40 348,160 ----a-w c:\windows\system32\msvcr71.dll 2008-08-25 13:52 315,392 ----a-w c:\windows\HideWin.exe 2008-08-20 05:38 659,456 ----a-w c:\windows\system32\wininet.dll 2008-08-17 03:56 1,049,784 ------w c:\windows\wweb32.dll 2008-08-14 09:58 2,136,064 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 09:22 2,015,744 ----a-w c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 356352] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2005-10-27 33792] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-23 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-23 162584] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-23 138008] "CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 729088] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-28 185872] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-07 1234712] "RTHDCPL"="RTHDCPL.EXE" [2007-11-30 c:\windows\RTHDCPL.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl] c:\documents and settings\Lenovo\Start Menu\Programs\Startup\ WordWeb.lnk - c:\program files\WordWeb\wweb32.exe [2008-09-23 42168] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2006-11-13 561213] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= c:\progra~1\Lenovo\Power2Go\CLMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-07 97928] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-07 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-07 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-07 76040] R3 CapFilt;CapFilt;c:\windows\system32\drivers\CapFilt.sys [2008-08-29 17536] S3 a016bus;Sony Ericsson Device A016 driver (WDM);c:\windows\system32\DRIVERS\a016bus.sys [2008-01-18 83880] S3 a016mdfl;Sony Ericsson Device A016 USB WMC Modeme Filter;c:\windows\system32\DRIVERS\a016mdfl.sys [2008-01-18 15016] S3 a016mdm;Sony Ericsson Device A016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\a016mdm.sys [2008-01-18 110504] S3 a016mgmt;Sony Ericsson Device A016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\a016mgmt.sys [2008-01-18 104488] S3 a016obex;Sony Ericsson Device A016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\a016obex.sys [2008-01-18 100648] S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2006-11-13 37296] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f347d98-738a-11dd-993e-001fe1f99edf}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL regsvr.exe \Shell\Open\command - H:\regsvr.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a626a17a-72c5-11dd-9939-001eec9186da}] \Shell\AutoRun\command - System\DriveGuard\DriveProtect.exe -run \Shell\Explore\Command - System\DriveGuard\DriveProtect.exe -run \Shell\Open\Command - System\DriveGuard\DriveProtect.exe -run [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe7baa74-8237-11dd-9953-001fe1f99edf}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL regsvr.exe \Shell\Open\command - H:\regsvr.exe *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder 2008-10-27 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] . - - - - ORPHANS REMOVED - - - - WebBrowser-{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} - (no file) HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe HKCU-Run-Power2GoExpress - (no file) HKCU-Run-fsm - (no file) HKLM-Run-VeriFacePassManager - c:\program files\Lenovo\VeriFace\PManage.exe . ------- Supplementary Scan ------- . R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore O8 -: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 -: Send to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm O17 -: HKLM\CCS\Interface\{9146E613-423D-48F0-9A4F-E5FFC6881271}: NameServer = 218.248.255.194 218.248.255.146 O17 -: HKLM\CCS\Interface\{FCE51623-65F4-4CE7-BF7E-126776340E48}: NameServer = 218.248.240.79,218.248.240.135 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-07 22:30:12 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-11-07 22:30:53 ComboFix-quarantined-files.txt 2008-11-07 17:00:48 Pre-Run: 30,591,221,760 bytes free Post-Run: 30,592,221,184 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 247 --- E O F --- 2008-11-05 16:01:34 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:40:16, on 11/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe C:\Program Files\WordWeb\wweb32.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\AVG\AVG8\aAvgApi.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Lenovo\Desktop\HiJackThis\scanner.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=111008 serial=DR12WEX-1504397-KTY lang=EN O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Bluetooth.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{9146E613-423D-48F0-9A4F-E5FFC6881271}: NameServer = 218.248.255.194 218.248.255.146 O17 - HKLM\System\CCS\Services\Tcpip\..\{FCE51623-65F4-4CE7-BF7E-126776340E48}: NameServer = 218.248.240.79,218.248.240.135 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- End of file - 7422 bytes
Hi, I am very thankful to you that you have helped me so much. I had posted the logs of both scanes. Just need to know do i need to keep all the exe. file which i have downloaded or can i delete after completing the task/ I am experencing my system a bit slow and any specific reason for that or it just my illusion? thanks sandy
Hey sandneet Please upload this file: C:\WINDOWS\system32\_psisdecd.dll to these two sites: www.virustotal.com and www.uploadmalware.com Post the results from www.virustotal.com here. After that, please read here for some info about how to fix a slow PC. http://windows.about.com/od/troubleshooting/tp/5waysperform.htm Best Regards
Hi D, Pl find the result pested below. File _psisdecd.dll_ received on 09.10.2008 17:58:11 (CET) Current status: finished Result: 0/36 (0.00%) Compact Print results Antivirus Version Last Update Result AhnLab-V3 2008.9.6.0 2008.09.10 - AntiVir 7.8.1.28 2008.09.10 - Authentium 5.1.0.4 2008.09.10 - Avast 4.8.1195.0 2008.09.10 - AVG 8.0.0.161 2008.09.10 - BitDefender 7.2 2008.09.10 - CAT-QuickHeal 9.50 2008.09.10 - ClamAV 0.93.1 2008.09.10 - DrWeb 4.44.0.09170 2008.09.10 - eSafe 7.0.17.0 2008.09.10 - eTrust-Vet 31.6.6082 2008.09.10 - Ewido 4.0 2008.09.10 - F-Prot 4.4.4.56 2008.09.09 - F-Secure 8.0.14332.0 2008.09.10 - Fortinet 3.112.0.0 2008.09.10 - GData 19 2008.09.10 - Ikarus T3.1.1.34.0 2008.09.10 - K7AntiVirus 7.10.450 2008.09.10 - Kaspersky 7.0.0.125 2008.09.10 - McAfee 5380 2008.09.09 - Microsoft 1.3903 2008.09.10 - NOD32v2 3429 2008.09.09 - Norman 5.80.02 2008.09.10 - Panda 9.0.0.4 2008.09.09 - PCTools 4.4.2.0 2008.09.10 - Prevx1 V2 2008.09.10 - Rising 20.61.22.00 2008.09.10 - Sophos 4.33.0 2008.09.10 - Sunbelt 3.1.1616.1 2008.09.09 - Symantec 10 2008.09.10 - TheHacker 6.3.0.9.077 2008.09.10 - TrendMicro 8.700.0.1004 2008.09.10 - VBA32 3.12.8.5 2008.09.10 - ViRobot 2008.9.10.1371 2008.09.10 - VirusBuster 4.5.11.0 2008.09.10 - Webwasher-Gateway 6.6.2 2008.09.10 - Additional information File size: 198144 bytes MD5...: dccf363dadfcf9bc838c7f81702a51b7 SHA1..: a0dc87a345d87874df9250e869eb35f0148911db SHA256: aa1de6bbb09ded409328bf2496ff302406e8119e594fa24ef8badadd645f3bff SHA512: 7764381cb4c143b35656e5dbcd18cf93004a37bf41bea174910cb7c842ef6ce9 b14dd9edc40f0206d742a6a705c0d4bcefd75ca0f440bec6517abf1117d7f91f PEiD..: - TrID..: File type identification DirectShow filter (52.6%) Windows OCX File (32.2%) Win32 Executable MS Visual C++ (generic) (9.8%) Win32 Executable Generic (2.2%) Win32 Dynamic Link Library (generic) (1.9%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x5e106893 timedatestamp.....: 0x415926d7 (Tue Sep 28 08:54:47 2004) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x27835 0x27a00 6.49 8ed065367f9ffa557db95a6b0b1f0f44 .data 0x29000 0x9d8 0x600 5.55 6a7f4f5e383a6f662bbfb44715002d83 .rsrc 0x2a000 0x5ef0 0x6000 5.81 7c2e780e40af0616240e03c8624ae456 .reloc 0x30000 0x2066 0x2200 5.80 2c4c22d5f626c69b6f2ab23686b4e29f ( 7 imports ) > msvcrt.dll: _purecall, free, _except_handler3, __3@YAXPAX@Z, __CxxFrameHandler, gmtime, realloc, malloc, mktime, wcstol, _vsnprintf, _ftol, wcschr, _CxxThrowException, _initterm, _adjust_fdiv, _terminate@@YAXXZ, __dllonexit, _onexit, __1type_info@@UAE@XZ, __2@YAPAXI@Z > MSVCP60.dll: __0_Lockit@std@@QAE@XZ, __1_Lockit@std@@QAE@XZ > KERNEL32.dll: GetProcessHeap, lstrlenA, HeapAlloc, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, SystemTimeToFileTime, lstrlenW, InterlockedIncrement, InterlockedDecrement, LocalFree, LocalAlloc, GetLastError, LockResource, LoadResource, FindResourceW, GetModuleHandleW, MultiByteToWideChar, lstrcpyW, lstrcmpiW, lstrcpynW, HeapDestroy, lstrcatW, GetModuleFileNameW, DisableThreadLibraryCalls, FreeLibrary, GetProcAddress, LoadLibraryW, HeapFree, SizeofResource, LoadLibraryExW, GetShortPathNameW > ADVAPI32.dll: RegEnumValueW, RegQueryValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegDeleteKeyW, RegCloseKey, RegCreateKeyExW, RegDeleteValueW, RegSetValueExW > USER32.dll: CharNextW > ole32.dll: CoTaskMemRealloc, CoTaskMemFree, CoCreateFreeThreadedMarshaler, CoCreateInstance, CoTaskMemAlloc > OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, - ( 4 exports ) DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
Hi D, Thank you so much for helping me with this problem. I hope my problem is solved now. You guys are really wonderful. I have submitted the file on uploadmakware site. Can i remove all the programms which i downloaded for cleaning this virus/malware Thanks a lot. rgds Sandneet
Your problem is solved now! You are clean! Yes, you can remove whatever programs we have used. Best Regards
