# Solved: VirusRemoval.vbs



## akfak (Oct 31, 2007)

Hello

I have successfully removed this virus (according to the scan of Kaspersky 7), but when I start the computer I still get the following message:

(In the titlebar): Windows Script Host
(Message): Can not find script file "C:\WINDOWS\system32\VirusRemoval.vbs."

Does this mean I still have the virus? Is this just a residual from having the virus? How can I get rid of it?

Thanks.


----------



## Cookiegal (Aug 27, 2003)

It's likely a registry key is still trying to load it.

*Click here* to download *HJTsetup.exe*.

Save HJTsetup.exe to your desktop.
Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This. 
Continue to click *Next* in the setup dialogue boxes until you get to the *Select Addition Tasks* dialogue.
Put a check by *Create a desktop icon* then click *Next* again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click *Finish* and it will launch Hijack This.
Click on the *Do a system scan and save a log file* button. It will scan and then ask you to save the log.
Click *Save* to save the log file and then the log will open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
*DO NOT* have Hijack This fix anything yet. Most of what it finds will be harmless or even required. 

*Note: During this process, it would help a great deal and be very much appreciated if you would refrain from installing any new software or hardware on this machine, unless absolutely necessary, until the clean up process is finished as it makes our job more tedious, with additional new files that may have to be researched, which is very time consuming.

Also, please do not run any security programs or fixes on your own as doing so may compromise what we will be doing. It is important that you wait for instructions.*


----------



## akfak (Oct 31, 2007)

the HijackThis file is below.

For the record, I did a registry search for all VirusRemoval.vbs entries, and there were about 5 or 6 entries. The problem is, I'm not sure what to do with them - if I should just delete the VirusRemoval.vbs part or if I should remove the whole thing. All of the entries are accompanied by wscript.exe...not sure if that's a good file or a bad one, so I haven't done anything.

The other keys are:
HKLM\Software\Microsoft\WindowsNT\Current Version\Winlogon
Name: Userinit
Type: REG_SZ
Data: C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\VirusRemoval.vbs

HKEY_USERS\S-1-5-21-1482476501-879983540-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoint....
(Sorry, I didn't write the whole key down, but there are two entries like this, and they both have the following data
Name: Default
Type: REG_SZ
Data: wscript.exe VirusRemoval.vbs

HKEY_CURRENT_USER\SoftwareSoftware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}\Shell\AutoRun\command
and
HKEY_CURRENT_USER\SoftwareSoftware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}\Shell\open\command
which both have the following info:
Name: Default
Type: REG_SZ
Data: wscript.exe VirusRemoval.vbs

I hope that helps. Or maybe it's too much info...I don't know...

Thanks for your help!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:26:59 PM, on 4/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\calc.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sujin.com.np/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Sujin.com.np
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\VirusRemoval.vbs
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [E07AXLRD_2836890] "C:\Program Files\Microsoft Encarta\Encarta Premium DVD 2007\EDICT.EXE" -m
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: Power Ge'ez 2005.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.801.1629 (GoogleDesktopManager-010108-205858) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 7012 bytes


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for downloading and running ComboFix:

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

Combofix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished.


----------



## akfak (Oct 31, 2007)

Not sure if this is some sort of joke or fluke or what...

But, when I tried to download this, a virus warning popped up for Heur Invader. I stopped whatever process it was trying to run, but the .exe file had already downloaded. I saved it onto a flash disk because the computer with the virus doesn't have internet at the moment.

When I plugged the flash disk into the computer with this problem, another virus warning popped up, saying that "virus Heur.Invader" was on Combofix.exe//PE_Patch.UPX/327882R2FWJFW\catchme.cfexe//PE_Patch.UPX

I have yet to run this Combo Fix program, but I won't do it while I'm getting all these virus warnings.

Is this what's supposed to happen?!?!?!


----------



## Cookiegal (Aug 27, 2003)

That's exactly why you are supposed to disable all anti-virus programs as they will disable ComboFix by removing some of its components. They are not malicious but are falsely detected by many anti-virus applications because of the nature of their function.

Please remove what the Combofix already downloaded, read the instructions carefully and download ComboFix again.


----------



## akfak (Oct 31, 2007)

I will try this again and let you know. For the record, I read the instructions carefully and it told me to disable the antivirus software before running ComboFix. It never told me I would get anti-virus warnings 1) upon download of the file and 2) upon clicking the removable disk that the executable is located on.

Thanks.


----------



## Cookiegal (Aug 27, 2003)

OK. I'm just wondering why are you not able to download it directly to the infected computer?


----------



## akfak (Oct 31, 2007)

Yeah...that would be the obvious question, I know.

I am in Ethiopia and don't have an internet connection on the computer that is infected (they tell me it's coming...I've been hearing it for about a month now). I use flash disks to transfer stuff from the computers that I do use the internet on to the computer that is now infected. 

Unfortunately, it's common belief here that having anti-virus software installed on your computer is enough...they don't consider updating the software...therein lies the problem. My flash disk gets infected every time I plug it in to one of these computers.

This is another reason why I'm so slow in responding. Thanks for your help (and patience).


----------



## Cookiegal (Aug 27, 2003)

Thanks for the clarification.

Are you able to run ComboFix?


----------



## akfak (Oct 31, 2007)

Hello!

I've disappeared for a while...sorry about that. I just went through the whole ComboFix thing. Then I rebooted my computer and that window at startup didn't show up, so that's good!

Here's the logfile:

ComboFix 08-06-20.4 - user 2008-06-25 12:04:34.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.91 [GMT 3:00]
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll

.
((((((((((((((((((((((((( Files Created from 2008-05-25 to 2008-06-25 )))))))))))))))))))))))))))))))
.

2008-06-23 12:02 . 2008-06-23 12:02 d--------	C:\WINDOWS\Sun
2008-06-22 19:38 . 2008-03-25 02:37	69,632	--a------	C:\WINDOWS\system32\javacpl.cpl
2008-06-22 19:36 . 2008-06-22 19:38 d--------	C:\Program Files\Java
2008-06-22 18:20 . 2008-06-22 18:20 d--------	C:\Program Files\Common Files\Java
2008-06-11 10:16 . 2008-05-08 17:02	203,136	-----c---	C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-11 08:33 . 2008-06-13 14:05	272,128	-----c---	C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\system32\scripting
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\system32\en
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\system32\bits
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\l2schemas
2008-06-07 20:28 . 2008-06-07 20:32 d--------	C:\WINDOWS\ServicePackFiles
2008-06-07 20:15 . 2008-06-07 20:15 d--------	C:\WINDOWS\EHome
2008-06-07 20:01 . 2008-04-14 03:12	4,274,816	---------	C:\WINDOWS\system32\nv4_disp.dll
2008-06-07 20:00 . 2008-04-14 03:12	1,737,856	---------	C:\WINDOWS\system32\mtxparhd.dll
2008-06-07 19:59 . 2004-08-03 22:41	1,041,536	---------	C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2008-06-07 19:58 . 2008-04-14 03:11	136,192	---------	C:\WINDOWS\system32\aaclient.dll
2008-06-07 19:58 . 2008-04-13 21:36	44,928	---------	C:\WINDOWS\system32\drivers\agpcpq.sys
2008-06-07 19:58 . 2008-04-13 21:36	42,368	---------	C:\WINDOWS\system32\drivers\agp440.sys
2008-06-07 19:58 . 2008-04-14 03:11	4,255	---------	C:\WINDOWS\system32\drivers\adv01nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,967	---------	C:\WINDOWS\system32\drivers\adv02nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,775	---------	C:\WINDOWS\system32\drivers\adv11nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,711	---------	C:\WINDOWS\system32\drivers\adv09nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,647	---------	C:\WINDOWS\system32\drivers\adv07nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,615	---------	C:\WINDOWS\system32\drivers\adv05nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,135	---------	C:\WINDOWS\system32\drivers\adv08nt5.dll
2008-06-07 15:10 . 2008-06-25 12:01	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2008-06-07 15:10 . 2008-06-07 15:10	1,409	--a------	C:\WINDOWS\QTFont.for
2008-06-07 15:08 . 2008-06-07 15:08 d--------	C:\Program Files\iPod
2008-06-07 15:07 . 2008-06-07 15:08 d--------	C:\Program Files\iTunes
2008-06-07 15:05 . 2008-06-07 15:05 d--------	C:\Program Files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 09:11	9,619,488	--sha-w	C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-25 09:11	531,744	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-25 09:02	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-25 09:01	50,636	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.idx
2008-06-25 09:01	104,492	--sha-w	C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-24 17:30	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Google Updater
2008-06-13 11:05	272,128	------w	C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 06:12	88,774	----a-w	C:\WINDOWS\system32\drivers\klick.dat
2008-05-29 08:06	96,966	----a-w	C:\WINDOWS\system32\drivers\klin.dat
2008-05-29 08:06	112,144	----a-w	C:\WINDOWS\system32\drivers\kl1.sys
2008-05-22 16:43	---------	d-----w	C:\Program Files\Microsoft Silverlight
2008-05-15 14:32	---------	d-----w	C:\Documents and Settings\user\Application Data\Launchy
2008-05-08 14:02	203,136	----a-w	C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-14 00:12	69,120	----a-w	C:\WINDOWS\notepad.exe
2008-04-14 00:12	50,688	----a-w	C:\WINDOWS\twain_32.dll
2008-04-14 00:12	32,866	------w	C:\WINDOWS\slrundll.exe
2008-04-14 00:12	283,648	----a-w	C:\WINDOWS\winhlp32.exe
2008-04-14 00:12	146,432	----a-w	C:\WINDOWS\regedit.exe
2008-04-14 00:12	10,752	----a-w	C:\WINDOWS\hh.exe
2008-04-14 00:12	1,033,728	----a-w	C:\WINDOWS\explorer.exe
2008-04-14 00:11	451,072	----a-w	C:\WINDOWS\AppPatch\aclayers.dll
2008-04-14 00:11	39,424	------w	C:\WINDOWS\AppPatch\acadproc.dll
2008-04-14 00:11	245,248	----a-w	C:\WINDOWS\AppPatch\acspecfc.dll
2008-04-14 00:11	141,312	----a-w	C:\WINDOWS\AppPatch\aclua.dll
2008-04-14 00:11	116,224	----a-w	C:\WINDOWS\AppPatch\acxtrnal.dll
2008-04-14 00:11	1,852,928	----a-w	C:\WINDOWS\AppPatch\acgenral.dll
2008-03-31 18:14	102,768	--sh--r	C:\6l6w8.com
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-29 03:25 94208]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 21:50 155648]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-03 04:41 45056]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 21:07 843776]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 00:22 3739648]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46 29744]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-02-19 14:56:19 125624]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2008-02-19 14:46:17 274432]
Power Ge'ez 2005.lnk - C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe [2008-02-15 02:45:05 499712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys [2006-09-14 06:01]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}]
\Shell\AutoRun\command - wscript.exe VirusRemoval.vbs
\Shell\open\Command - wscript.exe VirusRemoval.vbs

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-06-19 15:03:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-25 12:11:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-25 12:15:25
ComboFix-quarantined-files.txt 2008-06-25 09:15:20

Pre-Run: 9,680,240,640 bytes free
Post-Run: 10,501,378,048 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

148	--- E O F ---	2008-06-20 17:02:40


----------



## Cookiegal (Aug 27, 2003)

Open Notepad and copy and paste the text in the code box below into it:


```
File::
C:\6l6w8.com
C:\WINDOWS\system32\VirusRemoval.vbs

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{373c4757-f4bb-11dc-8dce-001aa025e80f}]
```
Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.


----------



## akfak (Oct 31, 2007)

Thanks!

Here's the ComboFix log:

ComboFix 08-06-20.4 - user 2008-06-26 10:10:01.2 - NTFSx86
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\6l6w8.com
C:\WINDOWS\system32\VirusRemoval.vbs
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\6l6w8.com

.
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.

2008-06-23 12:02 . 2008-06-23 12:02 d--------	C:\WINDOWS\Sun
2008-06-22 19:38 . 2008-03-25 02:37	69,632	--a------	C:\WINDOWS\system32\javacpl.cpl
2008-06-22 19:36 . 2008-06-22 19:38 d--------	C:\Program Files\Java
2008-06-22 18:20 . 2008-06-22 18:20 d--------	C:\Program Files\Common Files\Java
2008-06-11 10:16 . 2008-05-08 17:02	203,136	-----c---	C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-11 08:33 . 2008-06-13 14:05	272,128	-----c---	C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\system32\scripting
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\system32\en
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\system32\bits
2008-06-07 20:31 . 2008-06-07 20:31 d--------	C:\WINDOWS\l2schemas
2008-06-07 20:28 . 2008-06-07 20:32 d--------	C:\WINDOWS\ServicePackFiles
2008-06-07 20:15 . 2008-06-07 20:15 d--------	C:\WINDOWS\EHome
2008-06-07 20:01 . 2008-04-14 03:12	4,274,816	---------	C:\WINDOWS\system32\nv4_disp.dll
2008-06-07 20:00 . 2008-04-14 03:12	1,737,856	---------	C:\WINDOWS\system32\mtxparhd.dll
2008-06-07 19:59 . 2004-08-03 22:41	1,041,536	---------	C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2008-06-07 19:58 . 2008-04-14 03:11	136,192	---------	C:\WINDOWS\system32\aaclient.dll
2008-06-07 19:58 . 2008-04-13 21:36	44,928	---------	C:\WINDOWS\system32\drivers\agpcpq.sys
2008-06-07 19:58 . 2008-04-13 21:36	42,368	---------	C:\WINDOWS\system32\drivers\agp440.sys
2008-06-07 19:58 . 2008-04-14 03:11	4,255	---------	C:\WINDOWS\system32\drivers\adv01nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,967	---------	C:\WINDOWS\system32\drivers\adv02nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,775	---------	C:\WINDOWS\system32\drivers\adv11nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,711	---------	C:\WINDOWS\system32\drivers\adv09nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,647	---------	C:\WINDOWS\system32\drivers\adv07nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,615	---------	C:\WINDOWS\system32\drivers\adv05nt5.dll
2008-06-07 19:58 . 2008-04-14 03:11	3,135	---------	C:\WINDOWS\system32\drivers\adv08nt5.dll
2008-06-07 15:10 . 2008-06-26 09:51	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2008-06-07 15:10 . 2008-06-07 15:10	1,409	--a------	C:\WINDOWS\QTFont.for
2008-06-07 15:08 . 2008-06-07 15:08 d--------	C:\Program Files\iPod
2008-06-07 15:07 . 2008-06-07 15:08 d--------	C:\Program Files\iTunes
2008-06-07 15:05 . 2008-06-07 15:05 d--------	C:\Program Files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-26 07:13	9,685,792	--sha-w	C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-26 07:13	536,864	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-26 07:02	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Google Updater
2008-06-26 06:52	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-25 14:42	51,140	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.idx
2008-06-25 14:42	130,412	--sha-w	C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-13 11:05	272,128	------w	C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 06:12	88,774	----a-w	C:\WINDOWS\system32\drivers\klick.dat
2008-05-29 08:06	96,966	----a-w	C:\WINDOWS\system32\drivers\klin.dat
2008-05-29 08:06	112,144	----a-w	C:\WINDOWS\system32\drivers\kl1.sys
2008-05-22 16:43	---------	d-----w	C:\Program Files\Microsoft Silverlight
2008-05-15 14:32	---------	d-----w	C:\Documents and Settings\user\Application Data\Launchy
2008-05-08 14:02	203,136	----a-w	C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:12	1,288,192	----a-w	C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16	826,368	----a-w	C:\WINDOWS\system32\wininet.dll
2008-04-14 02:42	985,088	----a-w	C:\WINDOWS\system32\setupapi.dll
2008-04-14 02:42	11,264	----a-w	C:\WINDOWS\system32\spnpinst.exe
2008-04-14 02:41	423,936	----a-w	C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25	1,804	----a-w	C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16	329,728	----a-w	C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13	92,424	----a-w	C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13	87,176	----a-w	C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13	299,520	----a-w	C:\WINDOWS\system32\drmclien.dll
2008-04-14 00:13	12,168	----a-w	C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11	997,376	----a-w	C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10	53,279	----a-w	C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10	4,126	----a-w	C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10	3,584	----a-w	C:\WINDOWS\system32\msafd.dll
2008-04-13 21:00	103,424	----a-w	C:\WINDOWS\system32\dpcdll.dll
2008-04-13 19:30	1,845,632	----a-w	C:\WINDOWS\system32\win32k.sys
2008-04-13 19:24	2,145,280	----a-w	C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 18:44	17,664	----a-w	C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:35	24,064	----a-w	C:\WINDOWS\system32\pidgen.dll
2008-04-13 18:31	7,424	----a-w	C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31	2,023,936	----a-w	C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30	61,440	----a-w	C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14	76,800	------w	C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39	438,784	----a-w	C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39	2,897,920	----a-w	C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39	187,392	----a-w	C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37	208,384	----a-w	C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37	138,752	----a-w	C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:28	2,940,928	----a-w	C:\WINDOWS\system32\wmploc.dll
2008-04-13 17:27	79,872	----a-w	C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:26	94,208	----a-w	C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26	12,288	----a-w	C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26	12,288	----a-w	C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 17:24	20,480	----a-w	C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:23	8,192	----a-w	C:\WINDOWS\system32\asferror.dll
2008-04-13 17:23	168,448	----a-w	C:\WINDOWS\system32\wmerror.dll
2008-04-13 17:21	733,696	----a-w	C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09	4,096	----a-w	C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03	63,488	----a-w	C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03	549,376	----a-w	C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48	1,647,616	----a-w	C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45	216,064	----a-w	C:\WINDOWS\system32\moricons.dll
2008-04-13 16:23	48,128	----a-w	C:\WINDOWS\system32\msprivs.dll
2008-04-13 16:22	48,128	----a-w	C:\WINDOWS\system32\inetres.dll
2008-04-13 15:39	884,736	----a-w	C:\WINDOWS\system32\msimsg.dll
.

((((((((((((((((((((((((((((( [email protected]_12.14.56.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-25 09:01:47	2,048	--s-a-w	C:\WINDOWS\bootstat.dat
+ 2008-06-26 06:51:48	2,048	--s-a-w	C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-29 03:25 94208]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 21:50 155648]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-03 04:41 45056]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 21:07 843776]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 00:22 3739648]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46 29744]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-02-19 14:56:19 125624]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2008-02-19 14:46:17 274432]
Power Ge'ez 2005.lnk - C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe [2008-02-15 02:45:05 499712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys [2006-09-14 06:01]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77f5119f-e7d3-11dc-8dae-001aa025e80f}]
\Shell\Auto\command - F:\Folders.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Folders.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-06-19 15:03:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 10:13:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-26 10:14:52
ComboFix-quarantined-files.txt 2008-06-26 07:14:48
ComboFix2.txt 2008-06-25 09:15:26

Pre-Run: 10,649,190,400 bytes free
Post-Run: 11,149,336,576 bytes free

179	--- E O F ---	2008-06-20 17:02:40

----------------------------------------------------

And here's the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:16:30 AM, on 6/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sujin.com.np/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: Power Ge'ez 2005.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208243615234
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1208268406765
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 8149 bytes

Thanks again!


----------



## Cookiegal (Aug 27, 2003)

Can you tell me what your F drive is? Is it an external or flash drive?

Please insert it before doing the following:

I'm attaching a MountPoints Diagnostic.zip file to this post. Save it to your desktop. Unzjip it and double click the MountPoints Diagnostic.bat file and let it run. It will create a report in Notepad named Diagnostic.txt. Please upload the Diagnostic.txt file as an attachment.


----------



## akfak (Oct 31, 2007)

Yeah,

It looks like I've gotten a virus now on my flash disk, which is the F: drive. The problem is that no one here understands how to update their virus definitions, so if I need to give someone a document, my flash disk always gets a virus.

Question (which I suppose you'll help me answer anyway): How do I get rid of this virus? I always format the hard drive (taking the important docs off first, of course). Problem is, I've got another external hard drive with over 100GB of stuff on it that now has a virus. I don't have the storage anywhere else to move these docs to format the drive...I also think my iPod has a virus. (I am in virus hell!)

Anyway, I have attached the diagnostic.txt file. I see that it's got an autorun.inf file on it...


----------



## Cookiegal (Aug 27, 2003)

Be sure to insert the flash drive before doing this:

I'm attaching a Fixakfak.zip file. Save it to your desktop. Unzip it and double-click the akfak.reg file and allow it to enter into the registry.

Download *Flash_Disinfector.exe by sUBs* from *here* and save it to your desktop.
 Double-click *Flash_Disinfector.exe* to run it and follow any prompts that may appear.
 The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
 Wait until it has finished scanning and then exit the program.
 Reboot your computer when done.
*Note*: _Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection._

Open Notepad and copy and paste the text in the code box below into it:


```
File::
F:\Autorun.inf
F:\Folders.exe
C:\Folders.exe

Registry::
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77f5119f-e7d3-11dc-8dae-001aa025e80f}]
```
Now insert the other hard drive you are concerned about and run the Mountpoints Diagnostic tool again and post the new log please.

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.


----------



## akfak (Oct 31, 2007)

Back again!

Here are the logs:

Mountpoint log:

Diagnostic Report
Sat 08/09/2008 15:11:24.48

Mountpoints > Drives subkeys: 
------------------------------------

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,01,00,00,00,09,07,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell]
@="Open"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\AutoRun]
"Extended"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\AutoRun\command]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\explore]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\explore\Command]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\open]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\open\Command]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b0-db54-11dc-8d97-a258717d286d}\Shell\open\Default]
@="1"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,01,00,00,00,09,07,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell]
@="Open"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\AutoRun]
"Extended"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\AutoRun\command]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\explore]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\explore\Command]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\open]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\open\Command]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a2d50b1-db54-11dc-8d97-a258717d286d}\Shell\open\Default]
@="1"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20b2d0ae-0af1-11dd-8ce5-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,20,00,00,00,0a,00,00,00

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3b9e765f-1393-11dd-8d0e-001aa025e80f}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,10,00,00,09,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell]
@="Open"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\AutoRun]
"Extended"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\AutoRun\command]
@="pukka.scr 1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\explore]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\explore\Command]
@="pukka.scr 1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\open]
@="open"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\open\Command]
@="pukka.scr 1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\open\Default]
@="1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\Scan]
@="&Scan for virus..."

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\Shell\Scan\Command]
@="pukka.scr 2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\_Autorun]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\_Autorun\Action]
@="Open folder to view files"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}\_Autorun\DefaultIcon]
@="F:\\%SystemRoot%\\system32\\SHELL32.dll,4"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{424724e1-65d7-11dd-9f07-001aa025e80f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,01,00,00,00,08,00,00,00

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48a0b16f-4672-11dd-8de3-001aa025e80f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,10,00,00,08,00,00,00

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{60edf1fa-62a7-11dd-9efa-001aa025e80f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,10,00,00,09,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{60edf1fa-62a7-11dd-9efa-001aa025e80f}\shell]
@="AutoRun"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{60edf1fa-62a7-11dd-9efa-001aa025e80f}\shell\AutoRun]
@="Auto&Play"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{60edf1fa-62a7-11dd-9efa-001aa025e80f}\shell\AutoRun\command]
@="C:\\WINDOWS\\system32\\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\\Recycler\\svchost.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{60edf1fa-62a7-11dd-9efa-001aa025e80f}\shell\open]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{60edf1fa-62a7-11dd-9efa-001aa025e80f}\shell\open\command]
@=".\\Recycler\\svchost.exe"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{742792c1-da58-11dc-8d94-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\
5f,cf,cf,cf,5f,5f,5f,cf,cf,cf,5f,5f,cf,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,df,\
df,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,20,00,00,00,08,02,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{742792c1-da58-11dc-8d94-806d6172696f}\_Autorun]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{742792c1-da58-11dc-8d94-806d6172696f}\_Autorun\DefaultIcon]
@="E:\\ctrun\\cdglobe.ico"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{77f5119f-e7d3-11dc-8dae-001aa025e80f}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf65dfc-00ba-11dd-ba88-001aa025e80f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,02,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf65dfc-00ba-11dd-ba88-001aa025e80f}\shell]
@="None"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf65dfc-00ba-11dd-ba88-001aa025e80f}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ecf65dfc-00ba-11dd-ba88-001aa025e80f}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,01,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,00,00,10,00,00,09,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell]
@="Open"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\AutoRun]
"Extended"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\AutoRun\command]
@="F:\\scene.exe 1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\explore]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\explore\Command]
@="F:\\scene.exe 1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\open]
@="open"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\open\Command]
@="F:\\scene.exe 1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\open\Default]
@="1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\Scan]
@="&Scan for virus..."

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\Shell\Scan\Command]
@="F:\\scene.exe 2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\_Autorun]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\_Autorun\Action]
@="Open folder to view files"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}\_Autorun\DefaultIcon]
@="F:\\%SystemRoot%\\system32\\SHELL32.dll,4"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fbfe4f27-da56-11dc-ac17-806d6172696f}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fbfe4f28-da56-11dc-ac17-806d6172696f}]
"BaseClass"="Drive"

~~~~~~~~~~~~~~~~~~~~~~~~~ 
No Autorun files found in C:\WINDOWS

No Autorun files found in C:\WINDOWS\system32

C:\autorun.inf **folder** found 
Files in C:\autorun.inf 
lpt3.This folder was created by Flash_Disinfector

F:\autorun.inf **folder** found 
Files in F:\autorun.inf 
lpt3.This folder was created by Flash_Disinfector

G:\autorun.inf **folder** found 
Files in G:\autorun.inf 
lpt3.This folder was created by Flash_Disinfector

ComboFix log:

ComboFix 08-08-08.07 - user 2008-08-09 16:16:22.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.132 [GMT 3:00]Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Folders.exe
F:\Autorun.inf
F:\Folders.exe
.

((((((((((((((((((((((((( Files Created from 2008-07-09 to 2008-08-09 )))))))))))))))))))))))))))))))
.

2008-08-09 12:00 . 2008-08-09 12:00 d--------	C:\Program Files\Auslogics
2008-08-09 12:00 . 2008-08-09 12:00 d--------	C:\Documents and Settings\user\Application Data\Auslogics

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 13:23	14,689,056	--sha-w	C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-09 13:22	763,424	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-09 13:22	72,596	--sha-w	C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-09 13:22	198,824	--sha-w	C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-09 11:12	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-09 05:52	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-07 13:28	96,976	----a-w	C:\WINDOWS\system32\drivers\klin.dat
2008-08-03 16:02	---------	d-----w	C:\Program Files\Google
2008-07-23 17:36	87,855	----a-w	C:\WINDOWS\system32\drivers\klick.dat
2008-06-22 16:38	---------	d-----w	C:\Program Files\Java
2008-06-22 15:20	---------	d-----w	C:\Program Files\Common Files\Java
2008-06-20 11:51	361,600	----a-w	C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40	138,496	----a-w	C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08	225,856	----a-w	C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 11:05	272,128	------w	C:\WINDOWS\system32\drivers\bthport.sys
.

((((((((((((((((((((((((((((( [email protected]_12.14.56.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 17:02:28	163,328	----a-w	C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-08-03 16:02:53	26,694	----a-r	C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ARPPRODUCTICON.exe
+ 2008-08-03 16:02:53	26,694	----a-r	C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-08-03 16:02:53	26,694	----a-r	C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-08-03 16:02:53	26,694	----a-r	C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2008-08-03 16:02:53	26,694	----a-r	C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2008-08-03 16:02:53	26,694	----a-r	C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\UNINST_Uninstall_G_408FFBEED62349E08B232864A94D2864.exe
- 2008-06-11 17:09:26	593,920	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-07-09 18:34:33	593,920	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-06-11 17:09:26	12,288	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-07-09 18:34:33	12,288	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-06-11 17:09:26	86,016	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2008-07-09 18:34:33	86,016	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-06-11 17:09:25	135,168	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-07-09 18:34:33	135,168	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-06-11 17:09:26	11,264	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-07-09 18:34:34	11,264	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-06-11 17:09:26	27,136	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-07-09 18:34:34	27,136	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-06-11 17:09:26	4,096	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-07-09 18:34:34	4,096	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-06-11 17:09:27	794,624	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-07-09 18:34:34	794,624	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-06-11 17:09:25	249,856	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-07-09 18:34:33	249,856	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-06-11 17:09:25	61,440	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-07-09 18:34:33	61,440	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-06-11 17:09:27	23,040	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-07-09 18:34:34	23,040	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-06-11 17:09:25	286,720	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-07-09 18:34:33	286,720	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-06-11 17:09:25	409,600	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-07-09 18:34:33	409,600	----a-r	C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-06-14 16:12:58	16,384	----a-w	C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-07-21 17:38:42	16,384	----a-w	C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-14 16:12:58	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-07-21 17:38:42	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-14 16:12:58	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-21 17:38:42	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-04-14 00:12:15	139,264	----a-w	C:\WINDOWS\system32\cscript.exe
+ 2008-05-07 09:07:23	135,168	----a-w	C:\WINDOWS\system32\cscript.exe
+ 2008-06-20 11:40:08	138,496	-c----w	C:\WINDOWS\system32\dllcache\afd.sys
+ 2008-05-07 09:07:23	135,168	-c----w	C:\WINDOWS\system32\dllcache\cscript.exe
+ 2008-06-20 17:46:57	147,968	-c----w	C:\WINDOWS\system32\dllcache\dnsapi.dll
+ 2008-05-09 10:53:39	512,000	-c----w	C:\WINDOWS\system32\dllcache\jscript.dll
+ 2008-06-20 17:46:57	245,248	-c----w	C:\WINDOWS\system32\dllcache\mswsock.dll
+ 2008-05-09 10:53:39	180,224	-c----w	C:\WINDOWS\system32\dllcache\scrobj.dll
+ 2008-05-09 10:53:40	172,032	-c----w	C:\WINDOWS\system32\dllcache\scrrun.dll
+ 2008-06-20 11:51:12	361,600	-c----w	C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2008-06-20 11:08:27	225,856	-c----w	C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2008-05-09 10:53:40	430,080	-c----w	C:\WINDOWS\system32\dllcache\vbscript.dll
+ 2008-05-08 11:24:44	155,648	-c----w	C:\WINDOWS\system32\dllcache\wscript.exe
+ 2008-05-09 10:53:40	90,112	-c----w	C:\WINDOWS\system32\dllcache\wshext.dll
- 2008-04-14 00:11:52	147,968	----a-w	C:\WINDOWS\system32\dnsapi.dll
+ 2008-06-20 17:46:57	147,968	----a-w	C:\WINDOWS\system32\dnsapi.dll
- 2008-04-14 00:11:56	512,000	----a-w	C:\WINDOWS\system32\jscript.dll
+ 2008-05-09 10:53:39	512,000	----a-w	C:\WINDOWS\system32\jscript.dll
+ 2008-06-27 07:40:00	52,388	---ha-w	C:\WINDOWS\system32\mlfcache.dat
- 2008-05-29 23:35:11	17,486,968	----a-w	C:\WINDOWS\system32\MRT.exe
+ 2008-06-25 16:15:46	17,972,344	----a-w	C:\WINDOWS\system32\MRT.exe
- 2008-04-14 00:12:01	245,248	----a-w	C:\WINDOWS\system32\mswsock.dll
+ 2008-06-20 17:46:57	245,248	----a-w	C:\WINDOWS\system32\mswsock.dll
- 2008-04-14 00:12:05	180,224	----a-w	C:\WINDOWS\system32\scrobj.dll
+ 2008-05-09 10:53:39	180,224	----a-w	C:\WINDOWS\system32\scrobj.dll
- 2008-04-14 00:12:05	172,032	----a-w	C:\WINDOWS\system32\scrrun.dll
+ 2008-05-09 10:53:40	172,032	----a-w	C:\WINDOWS\system32\scrrun.dll
- 2007-11-30 11:18:51	17,272	------w	C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:22	17,272	------w	C:\WINDOWS\system32\spmsg.dll
- 2008-04-14 00:12:08	434,176	----a-w	C:\WINDOWS\system32\vbscript.dll
+ 2008-05-09 10:53:40	430,080	----a-w	C:\WINDOWS\system32\vbscript.dll
- 2008-04-14 00:12:41	155,648	----a-w	C:\WINDOWS\system32\wscript.exe
+ 2008-05-08 11:24:44	155,648	----a-w	C:\WINDOWS\system32\wscript.exe
- 2008-04-14 00:12:10	90,112	----a-w	C:\WINDOWS\system32\wshext.dll
+ 2008-05-09 10:53:40	90,112	----a-w	C:\WINDOWS\system32\wshext.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-29 03:25 94208]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 21:50 155648]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-03 04:41 45056]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 21:07 843776]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 00:22 3739648]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-18 18:46 29744]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-12-18 00:43 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-02-19 14:56:19 125624]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2008-02-19 14:46:17 274432]
Power Ge'ez 2005.lnk - C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe [2008-02-15 02:45:05 499712]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R0 atiide;atiide;C:\WINDOWS\system32\DRIVERS\atiide.sys [2006-09-14 06:01]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-04-18 18:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40d94f79-5e1b-11dd-9ee8-001aa025e80f}]
\Shell\AutoRun\command - pukka.scr 1
\Shell\explore\Command - pukka.scr 1
\Shell\open\Command - pukka.scr 1
\Shell\Scan\Command - pukka.scr 2

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f30f8061-4d8a-11dd-9eaf-001aa025e80f}]
\Shell\AutoRun\command - F:\scene.exe 1
\Shell\explore\Command - F:\scene.exe 1
\Shell\open\Command - F:\scene.exe 1
\Shell\Scan\Command - F:\scene.exe 2
.
Contents of the 'Scheduled Tasks' folder

2008-08-07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-09 16:23:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2008-08-09 16:29:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-09 13:28:49
ComboFix2.txt 2008-06-26 07:14:53
ComboFix3.txt 2008-06-25 09:15:26

Pre-Run: 9,895,956,480 bytes free
Post-Run: 9,982,332,928 bytes free

197	--- E O F ---	2008-07-11 05:25:36

Hijack this log in next post since it's too long...


----------



## akfak (Oct 31, 2007)

Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:19 PM, on 8/9/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sujin.com.np/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: Power Ge'ez 2005.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208243615234
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1208268406765
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 7871 bytes


----------



## Cookiegal (Aug 27, 2003)

I'm sorry but it took you over a month to reply and I wasn't notified of your response.

Do you still need assistance with this?

If so, please run the Mountpoints Diagnostic tool again and post that log along with a new HijackThis log.


----------



## akfak (Oct 31, 2007)

Yeah...sorry about my delay to begin with. All is fine now. I really appreciate your help.


----------



## Cookiegal (Aug 27, 2003)

OK. Thanks for replying back. 

Since this issue has been resolved, I'm closing this thread. 

If the thread starter needs it to be reopened, please contact a moderator.


----------

