puddytat94
2008-01-19, 18:04
I have a dual boot OS with windows vista and xp. My infection problems are in XP with pop ups happening when I use IE or Firefox. The popups have stopped since I deactivated some suspicious active x add ons in IE. However, multiple attempts to remove this malware on my own with my usual techniques of deleting unauthorized registry entries in HKLM-software-microsoft-windows-current version-run have proved unsuccessful. I've changed the sbcdisable key under HKLM-software-microsoft-windowsnt-current version-winlogon from 4 back to 0 multiple times and keep experiencing reinfestation. I have tried several fixes and can be more specific if you need. Here is my Kaspersky Online Scan text file.
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, January 19, 2008 10:28:51 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/01/2008
Kaspersky Anti-Virus database records: 523769
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
G:\
Scan Statistics:
Total number of scanned objects: 127617
Number of viruses found: 17
Number of infected objects: 33
Number of suspicious objects: 2
Duration of the scan process: 01:05:07
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-01142008-214646.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Wendy\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Desktop\SDFix\SDFix\backups\backups.zip/backups/b122.exe Infected: Trojan-Downloader.Win32.Agent.haq skipped
C:\Documents and Settings\Wendy\Desktop\SDFix\SDFix\backups\backups.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Wendy\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Wendy\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\History\History.IE5\MSHist012008011920080120\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\temp\~DF4B2D.tmp Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\temp\~DF4B32.tmp Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\ntuser.dat Object is locked skipped
C:\Documents and Settings\Wendy\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\Flash Music Studio 1.0\FMStudio.exe Suspicious: Packed.Win32.PePatch.dk skipped
C:\Program Files\Mozilla Firefox\vvqq.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\Program Files\Mozilla Firefox\vvqq.exe/stream Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\Program Files\Mozilla Firefox\vvqq.exe NSIS: infected - 2 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\VundoFix Backups\jkklm.exe.bad Infected: Trojan-Dropper.Win32.Agent.dgo skipped
C:\VundoFix Backups\mlisknln.exe.bad Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{BA48163D-C028-4E48-B846-00DBB19A7F8F}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\ctfmon.exe.tmp Infected: Trojan-Dropper.Win32.Agent.dgo skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\hiberfil.sys Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\Users\Home\AppData\Local\Temp\NeroDemo12550\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
D:\Users\Home\AppData\Local\Temp\~DFDB0A.tmp Object is locked skipped
D:\Windows\CSC\v2.0.6\pq Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl Object is locked skipped
G:\Installs\Flash Music Studio 1.0\Crack\FMStudio.exe Suspicious: Packed.Win32.PePatch.dk skipped
G:\Installs\ISOBuster\Smart.Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT.rar/run.exe Infected: Trojan-Downloader.Win32.Zlob.bcl skipped
G:\Installs\ISOBuster\Smart.Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT.rar RAR: infected - 1 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\Advisory.txt Infected: Backdoor.IRC.Flood.a skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\NortonPID.hlp Infected: Backdoor.IRC.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\OS32.ini Infected: IRC-Worm.IRC.Froze skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\pnc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\ret.bat Infected: Trojan.BAT.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\smnt.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\spsexec.exe Infected: not-a-virus:RiskTool.Win32.PsExec.13 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\WINClock.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.507 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\winhelper.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\WinOS.hlp Infected: Backdoor.IRC.Cloner skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/Advisory.nfo Infected: Backdoor.IRC.Flood.a skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/NortonPID.hlp Infected: Backdoor.IRC.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/OS32.ini Infected: IRC-Worm.IRC.Froze skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/pnc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/ret.bat Infected: Trojan.BAT.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/smnt.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/spsexec.exe Infected: not-a-virus:RiskTool.Win32.PsExec.13 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/WINClock.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.507 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/winhelper.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/WinOS.hlp Infected: Backdoor.IRC.Cloner skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe ZIP: infected - 10 skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Scan process completed.
And here is my HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:12 AM, on 1/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {31D42F59-3235-499E-9385-CE5CC15C3689} - C:\WINDOWS\system32\jkklm.dll (file missing)
O2 - BHO: {4c727eb8-dee5-49c9-2444-ee7064735c53} - {35c53746-07ee-4442-9c94-5eed8be727c4} - C:\WINDOWS\system32\pideshfv.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: my.bat
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB92B39B-C3F5-4923-98E4-3FC77E18ECC8}: NameServer = 205.240.64.156,137.118.1.32
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
--
End of file - 5365 bytes
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, January 19, 2008 10:28:51 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/01/2008
Kaspersky Anti-Virus database records: 523769
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
G:\
Scan Statistics:
Total number of scanned objects: 127617
Number of viruses found: 17
Number of infected objects: 33
Number of suspicious objects: 2
Duration of the scan process: 01:05:07
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-01142008-214646.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Wendy\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Desktop\SDFix\SDFix\backups\backups.zip/backups/b122.exe Infected: Trojan-Downloader.Win32.Agent.haq skipped
C:\Documents and Settings\Wendy\Desktop\SDFix\SDFix\backups\backups.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Wendy\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Wendy\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\History\History.IE5\MSHist012008011920080120\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\temp\~DF4B2D.tmp Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\temp\~DF4B32.tmp Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Wendy\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Wendy\ntuser.dat Object is locked skipped
C:\Documents and Settings\Wendy\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\Flash Music Studio 1.0\FMStudio.exe Suspicious: Packed.Win32.PePatch.dk skipped
C:\Program Files\Mozilla Firefox\vvqq.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\Program Files\Mozilla Firefox\vvqq.exe/stream Infected: not-a-virus:AdWare.Win32.Agent.vv skipped
C:\Program Files\Mozilla Firefox\vvqq.exe NSIS: infected - 2 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\VundoFix Backups\jkklm.exe.bad Infected: Trojan-Dropper.Win32.Agent.dgo skipped
C:\VundoFix Backups\mlisknln.exe.bad Infected: Trojan-Downloader.Win32.Agent.gwe skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{BA48163D-C028-4E48-B846-00DBB19A7F8F}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\ctfmon.exe.tmp Infected: Trojan-Dropper.Win32.Agent.dgo skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\hiberfil.sys Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\Users\Home\AppData\Local\Temp\NeroDemo12550\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
D:\Users\Home\AppData\Local\Temp\~DFDB0A.tmp Object is locked skipped
D:\Windows\CSC\v2.0.6\pq Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl Object is locked skipped
D:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl Object is locked skipped
G:\Installs\Flash Music Studio 1.0\Crack\FMStudio.exe Suspicious: Packed.Win32.PePatch.dk skipped
G:\Installs\ISOBuster\Smart.Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT.rar/run.exe Infected: Trojan-Downloader.Win32.Zlob.bcl skipped
G:\Installs\ISOBuster\Smart.Projects.IsoBuster.Pro.v1.9.1.1.Multilingual.Incl.KeyMaker-DVT.rar RAR: infected - 1 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\Advisory.txt Infected: Backdoor.IRC.Flood.a skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\NortonPID.hlp Infected: Backdoor.IRC.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\OS32.ini Infected: IRC-Worm.IRC.Froze skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\pnc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\ret.bat Infected: Trojan.BAT.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\smnt.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\spsexec.exe Infected: not-a-virus:RiskTool.Win32.PsExec.13 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\WINClock.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.507 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\winhelper.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero\WinOS.hlp Infected: Backdoor.IRC.Cloner skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/Advisory.nfo Infected: Backdoor.IRC.Flood.a skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/NortonPID.hlp Infected: Backdoor.IRC.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/OS32.ini Infected: IRC-Worm.IRC.Froze skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/pnc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/ret.bat Infected: Trojan.BAT.Zapchast skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/smnt.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/spsexec.exe Infected: not-a-virus:RiskTool.Win32.PsExec.13 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/WINClock.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.507 skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/winhelper.exe Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe/WinOS.hlp Infected: Backdoor.IRC.Cloner skipped
G:\Installs\Nero 7\Ahead.Nero.v7.10.1.0.Incl.Keymaker-EMBRACE\Nero.exe ZIP: infected - 10 skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Scan process completed.
And here is my HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:12 AM, on 1/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {31D42F59-3235-499E-9385-CE5CC15C3689} - C:\WINDOWS\system32\jkklm.dll (file missing)
O2 - BHO: {4c727eb8-dee5-49c9-2444-ee7064735c53} - {35c53746-07ee-4442-9c94-5eed8be727c4} - C:\WINDOWS\system32\pideshfv.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: my.bat
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB92B39B-C3F5-4923-98E4-3FC77E18ECC8}: NameServer = 205.240.64.156,137.118.1.32
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
--
End of file - 5365 bytes