Solved winini.exe and msasno.dll

[Resolved] winini.exe and msasno.dll

Recently, i ran kaspersky online scanner and it found these files as trojans...winini.exe and msasno.dll in the C:\WINDOWS\system32 folder. I managed to delete winini.exe directly and msasno.dll through the safe mode. I also ran Panda Activescan which found gendel32 in C:\WINDOWS folder as a "security risk" (i've not deleted this yet).

These are the problems that i have had before and even after deleting the above mentioned files:

1. Very slow windows startup...about 7-10 mins.
2. McAfee Systemguard usually gets disabled at startup and also sometimes when just using the computer.
3. Internet Explorer also very slow to startup (i have IE7).
4. Had a few Vundo viruses (e.g. geeda.dll...etc.) before, which was detected by Spybot. Deleted them through Vundofix.Now the computer is clean from Vundos.

Now i'm not sure whether there are still viruses & trojans present and if they're causing the above problems.

Any help or suggestion will be greatly appreciated. Thanx

 

Welcome to WindowsBBS Shadowdancer

Lets have a look at things. Download Deckard's System Scanner (dss.exe) and save it to your desktop.

• Close all applications and windows.
• Double click on dss.exe to run it and follow the prompts.
• When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.

Post the contents of main.txt only for now.

 

Thank you noahdfear for your reply.

I've managed to delete the gendel32.exe which was in C:\WINDOWS through safe mode. Deckard scan result is as below,


Deckard's System Scanner v20071014.68
Run by CK on 2008-03-27 10:43:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 224 MiB (512 MiB recommended).


-- HijackThis (run as CK.exe) --------------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-03-27 10:46:25
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee\VirusScan\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\McAfee\VirusScan\mcsysmon.exe
C:\Documents and Settings\CK\Desktop\dss.exe
D:\Downloads\CK.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy1.saudi.net.sa:8080
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: (no name) - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: TweakMASTER Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\Program Files\TweakMASTER\TweakBHO.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar2.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: about://internet (HKCU)
O15 - Trusted Zone: http://mcafee.com (HKCU)
O15 - Trusted Zone: https://mcafee.com (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} () - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://www.bpp.com/acca/study-materials/ilearn/common/activex/awswaxd.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/downl...-495c-b89f-c1c34c691085/LegitCheckControl.cab
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {436ABEF3-3479-4703-B4A9-64268AEFFEE9} (SopCore Control) - http://www.joytopic.com/download/SOPCORE.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://download.sopcast.com/download/SOPCORE.CAB
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} () - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.mydesichannel.com/nsvplayx_vp3_mp3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\msksrver.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe


--
End of file - 12423 bytes

-- Files created between 2008-02-27 and 2008-03-27 -----------------------------

2008-03-24 13:38:40 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-03-24 12:15:28 0 d-------- C:\Program Files\SpywareGuard
2008-03-24 12:01:35 0 d-------- C:\Program Files\SpywareBlaster
2008-03-24 11:01:39 0 d-------- C:\IE-SPYAD
2008-03-21 05:23:50 0 d-------- C:\Documents and Settings\CK\Application Data\TVU networks
2008-03-21 05:23:50 0 d-------- C:\Documents and Settings\All Users\Application Data\TVU networks
2008-03-21 05:23:34 0 d-------- C:\Program Files\TVUPlayer
2008-03-17 17:57:20 0 d-------- C:\Documents and Settings\CK\Application Data\McAfee
2008-03-16 15:55:18 0 d-------- C:\Documents and Settings\Hira\Application Data\SiteAdvisor
2008-03-15 22:36:51 0 d-------- C:\Documents and Settings\Baby\Application Data\SiteAdvisor
2008-03-15 02:34:30 0 d-------- C:\Program Files\7-Zip
2008-03-14 17:10:08 0 d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-03-14 17:09:30 0 d-------- C:\Program Files\SiteAdvisor
2008-03-14 17:09:29 0 d-------- C:\Documents and Settings\CK\Application Data\SiteAdvisor
2008-03-14 17:09:29 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-03-14 17:08:27 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL>
2008-03-14 17:03:36 0 d-------- C:\Program Files\McAfee.com
2008-03-14 17:03:00 0 d-------- C:\Program Files\Common Files\McAfee
2008-03-14 17:02:35 0 d-------- C:\Program Files\McAfee
2008-03-14 16:36:26 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-03-12 13:45:32 0 d-------- C:\Program Files\File Shredder
2008-03-09 19:50:41 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-09 00:04:17 0 d-------- C:\Program Files\PCPitstop
2008-03-04 15:02:25 0 d-------- C:\Program Files\CCleaner
2008-03-03 17:38:03 0 d-------- C:\Documents and Settings\CK\Application Data\WinPatrol
2008-03-03 17:35:24 0 d-------- C:\Program Files\BillP Studios
2008-02-28 19:16:02 0 d-------- C:\WINDOWS\CAVTemp
2008-02-28 18:36:44 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-02-28 18:33:50 0 d-------- C:\WINDOWS\system32\ZoneLabs


-- Find3M Report ---------------------------------------------------------------

2008-03-27 10:22:30 0 d-------- C:\Program Files\FlashGet
2008-03-26 13:31:24 0 d-------- C:\Program Files\Windows Defender
2008-03-26 13:30:04 0 d-------- C:\Program Files\TweakMASTER
2008-03-26 13:19:43 0 d-------- C:\Program Files\Google
2008-03-26 13:18:59 0 d-------- C:\Program Files\Freecorder
2008-03-26 10:50:20 0 d-------- C:\Program Files\PowerISO
2008-03-26 10:50:19 0 d-------- C:\Program Files\MagicISO
2008-03-16 05:43:03 5536 --a------ C:\WINDOWS\unins000.dat
2008-03-16 05:39:59 691545 --a------ C:\WINDOWS\unins000.exe
2008-03-15 03:35:00 0 d-------- C:\Program Files\Common Files\Adobe
2008-03-14 17:03:00 0 d-------- C:\Program Files\Common Files
2008-03-09 19:55:01 0 d-------- C:\Program Files\MSN Messenger
2008-03-09 19:53:59 0 d-------- C:\Program Files\Windows Live
2008-03-06 21:12:11 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-03-03 17:15:42 0 d-------- C:\Program Files\Athan
2008-03-02 00:06:57 0 d-------- C:\Documents and Settings\CK\Application Data\Winamp
2008-02-29 12:10:03 0 d-------- C:\Program Files\Virtual CD v4
2008-02-26 13:46:46 0 d-------- C:\Program Files\DivX
2008-02-26 10:03:32 0 d-------- C:\Documents and Settings\CK\Application Data\Uniblue
2008-02-26 10:02:57 0 d-------- C:\Program Files\Uniblue
2008-02-23 14:45:18 0 d-------- C:\Program Files\EA Sports
2008-02-22 12:04:20 283 --a------ C:\WINDOWS\EReg072.dat
2008-02-10 05:50:20 1277 --a------ C:\WINDOWS\mozver.dat
2008-02-10 05:49:51 0 d-------- C:\Documents and Settings\CK\Application Data\Sun
2008-02-10 05:48:14 0 d-------- C:\Program Files\Java
2008-02-10 05:43:30 0 d-------- C:\Program Files\Common Files\Java
2008-02-03 16:45:03 0 d-------- C:\Program Files\Lavasoft
2008-02-03 16:43:46 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 19:08:23 0 d-------- C:\Program Files\EA GAMES
2008-02-01 05:26:44 262144 --a------ C:\ntuser.dat
2008-02-01 03:13:16 0 d-------- C:\Program Files\Microsoft Works
2008-02-01 03:12:49 0 d-------- C:\Program Files\MSBuild
2008-02-01 01:01:31 0 d-------- C:\Program Files\Microsoft.NET
2008-02-01 01:01:29 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-01-31 17:06:29 0 d-------- C:\Program Files\DAP
2008-01-30 23:38:29 19240 --a------ C:\WINDOWS\BootTime.dat
2008-01-29 17:36:13 134547 --a------ C:\WINDOWS\system32\keygen.exe
2008-01-21 22:46:49 1187 --a------ C:\WINDOWS\wmplayer.reg
2008-01-14 17:29:48 664 --a------ C:\WINDOWS\system32\d3d9caps.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
12/07/2007 01:07 PM 1502232 --a------ C:\Program Files\Freecorder\tbFre1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}]
11/26/2007 10:46 AM 324936 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612} "= C:\Program Files\Freecorder\tbFre1.dll [12/07/2007 01:07 PM 1502232]

[-HKEY_CLASSES_ROOT\CLSID\{1392B8D2-5C05-419F-A8F6-B9F15A596612}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 07:20 PM]
"mcagent_exe "= "C:\Program Files\McAfee.com\Agent\mcagent.exe" [11/01/2007 07:12 PM]
"SiteAdvisor "= "C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [08/25/2007 12:57 AM]
"WinPatrol "= "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [08/02/2007 07:59 PM]

C:\Documents and Settings\CK\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [8/29/2003 7:05:35 PM]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages "= msv1_0 C:\WINDOWS\system32\vtutq.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McENUI]
C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer "=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe




-- End of Deckard's System Scanner: finished at 2008-03-27 10:49:32 ------------

 

Did you install the following file, or a program to generate software or password keys that may have installed it?

C:\WINDOWS\system32\keygen.exe


Did you set a proxy server for your internet connection?

proxy1.saudi.net.sa:8080


Scan again with HijackThis and place a check next to the following entries, then click Fix Checked.

O15 - Trusted Zone: about://internet (HKCU)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () -

Close HijackThis.



Download ComboFix by sUBs from here, saving the file to your desktop. If you do not have an XP SP2 cd (an Operating System disc, not a Recovery cd), I recommend you first install the Recovery Console as outlined below.


Install the Recovery Console

Download the installation package Setup Disks for Floppy Boot Install from Microsoft so that it can be used to install the Recovery Console on your computer. No validation required! Please select the download link below that's appropriate for your Operating System, then download and save the setup package to your desktop. If necessary, change the language version to match your installation. Do NOT change the name of the downloaded file!

• Microsoft Windows XP Home Edition
  • Service Pack 2
    http://www.microsoft.com/downloads/details.aspx?FamilyId=15491F07-99F7-4A2D-983D-81C2137FF464
  
  
• Microsoft Windows XP Professional
  • Service Pack 2
    http://www.microsoft.com/downloads/details.aspx?FamilyId=535D248D-5E10-49B5-B80C-0A0205368124

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.




If you do have an XP SP2 cd (an Operating System disc, not a Recovery cd), you can proceed as follows:

Please disable realtime protection applications as they sometime interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

 

Regarding the Keygen.exe, i probably did installed it. However not sure for which program and when. Should i delete it? And for the internet connection, yes i did set it, but removed it before reading your latest post. Was that right? The internet is working fine though.

Scanned with HijackThis, this entry is "no longer there ":

O15 - Trusted Zone: about://internet (HKCU)

However, FIXED the other one, i.e.

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () -


Below is COMBOFIX LOG,


ComboFix 08-03-26.3 - CK 2008-03-28 5:58:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.30 [GMT 3:00]
Running from: C:\Documents and Settings\CK\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
-- Script messages for sUBs --
Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement"
GREP -Eisf temp00
VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll"

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Baby\Application Data\FunWebProducts
C:\Documents and Settings\Baby\Application Data\FunWebProducts\Data\Baby\OneNote Table Of Contents.onetoc2
C:\Documents and Settings\Baby\Application Data\FunWebProducts\Data\OneNote Table Of Contents.onetoc2
C:\Documents and Settings\Baby\Application Data\FunWebProducts\OneNote Table Of Contents.onetoc2
C:\Documents and Settings\Baby\Application Data\macromedia\Flash Player\#SharedObjects\ZF5N4V7K\iforex.com
C:\Documents and Settings\Baby\Application Data\macromedia\Flash Player\#SharedObjects\ZF5N4V7K\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Baby\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Baby\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\CK\Application Data\macromedia\Flash Player\#SharedObjects\VS8B7BBE\iforex.com
C:\Documents and Settings\CK\Application Data\macromedia\Flash Player\#SharedObjects\VS8B7BBE\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\CK\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\CK\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\Hira\Application Data\macromedia\Flash Player\#SharedObjects\8JDUWZCR\iforex.com
C:\Documents and Settings\Hira\Application Data\macromedia\Flash Player\#SharedObjects\8JDUWZCR\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Hira\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Hira\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\sndrec32.exe

.
((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-28 )))))))))))))))))))))))))))))))
.

2008-03-27 11:23 . 2008-03-27 11:29 <DIR> d-------- C:\Documents and Settings\CK\SecurityScans
2008-03-27 11:22 . 2008-03-27 11:23 <DIR> d-------- C:\Program Files\Microsoft Baseline Security Analyzer 2
2008-03-27 10:42 . 2008-03-27 10:42 <DIR> d-------- C:\Deckard
2008-03-24 13:38 . 2008-03-26 14:14 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-24 13:38 . 2008-03-26 11:59 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-24 13:38 . 2008-03-26 11:59 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-24 13:38 . 2008-03-26 11:59 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-24 12:15 . 2008-03-27 16:23 <DIR> d-------- C:\Program Files\SpywareGuard
2008-03-24 12:01 . 2008-03-27 16:20 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-24 12:01 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-24 11:01 . 2008-03-24 11:04 <DIR> d-------- C:\IE-SPYAD
2008-03-21 05:23 . 2008-03-21 05:23 <DIR> d-------- C:\Program Files\TVUPlayer
2008-03-21 05:23 . 2008-03-21 05:24 <DIR> d-------- C:\Documents and Settings\CK\Application Data\TVU networks
2008-03-21 05:23 . 2008-03-21 05:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TVU networks
2008-03-17 17:57 . 2008-03-17 17:57 <DIR> d-------- C:\Documents and Settings\CK\Application Data\McAfee
2008-03-16 15:55 . 2008-03-16 15:55 <DIR> d-------- C:\Documents and Settings\Hira\Application Data\SiteAdvisor
2008-03-16 05:35 . 2008-03-16 05:44 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-15 22:36 . 2008-03-25 10:27 <DIR> d-------- C:\Documents and Settings\Baby\Application Data\SiteAdvisor
2008-03-15 02:34 . 2008-03-26 10:50 <DIR> d-------- C:\Program Files\7-Zip
2008-03-14 17:11 . 2008-03-28 06:06 13,091 --a------ C:\WINDOWS\system32\Config.MPF
2008-03-14 17:10 . 2008-03-14 17:10 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-03-14 17:09 . 2008-03-15 20:09 <DIR> d-------- C:\Program Files\SiteAdvisor
2008-03-14 17:09 . 2008-03-27 10:54 <DIR> d-------- C:\Documents and Settings\CK\Application Data\SiteAdvisor
2008-03-14 17:09 . 2008-03-14 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-03-14 17:08 . 2006-03-03 08:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-03-14 17:05 . 2007-11-22 06:44 201,320 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-03-14 17:05 . 2007-07-13 06:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-03-14 17:05 . 2007-11-22 06:44 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-03-14 17:05 . 2007-12-02 12:51 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-03-14 17:05 . 2007-11-22 06:44 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-03-14 17:05 . 2007-11-22 06:44 33,832 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-03-14 17:03 . 2008-03-14 17:04 <DIR> d-------- C:\Program Files\McAfee.com
2008-03-14 17:03 . 2008-03-14 17:05 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-03-14 17:02 . 2008-03-18 14:31 <DIR> d-------- C:\Program Files\McAfee
2008-03-14 16:36 . 2008-03-14 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-03-12 13:45 . 2008-03-26 10:50 <DIR> d-------- C:\Program Files\File Shredder
2008-03-09 19:50 . 2008-03-09 19:51 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-09 00:04 . 2008-03-09 00:04 <DIR> d-------- C:\Program Files\PCPitstop
2008-03-04 15:02 . 2008-03-04 15:02 <DIR> d-------- C:\Program Files\CCleaner
2008-03-03 17:38 . 2008-03-03 17:38 <DIR> d-------- C:\Documents and Settings\CK\Application Data\WinPatrol
2008-03-03 17:35 . 2008-03-03 17:35 <DIR> d-------- C:\Program Files\BillP Studios
2008-02-28 19:16 . 2008-03-06 22:25 <DIR> d-------- C:\WINDOWS\CAVTemp
2008-02-28 18:36 . 2008-02-29 11:39 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-02-28 18:33 . 2008-03-10 19:35 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-28 02:46 --------- d-----w C:\Program Files\FlashGet
2008-03-27 13:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-26 10:31 --------- d-----w C:\Program Files\Windows Defender
2008-03-26 10:30 --------- d-----w C:\Program Files\TweakMASTER
2008-03-26 10:19 --------- d-----w C:\Program Files\Google
2008-03-26 10:18 --------- d-----w C:\Program Files\Freecorder
2008-03-26 07:50 --------- d-----w C:\Program Files\PowerISO
2008-03-26 07:50 --------- d-----w C:\Program Files\MagicISO
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\Yahoo!
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\Winamp
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\VersionTracker Pro
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\PC Suite
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\MusicIP
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\Leadertech
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\GetRightToGo
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\FlashGet
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\Ahead
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\AdobeUM
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\AdobeAUM
2008-03-25 07:27 --------- d-----w C:\Documents and Settings\Baby\Application Data\ACD Systems
2008-03-16 02:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-16 02:39 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-03-15 00:35 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-12 09:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-09 16:55 --------- d-----w C:\Program Files\MSN Messenger
2008-03-09 16:53 --------- d-----w C:\Program Files\Windows Live
2008-03-09 16:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-06 18:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 14:15 --------- d-----w C:\Program Files\Athan
2008-03-01 21:06 --------- d-----w C:\Documents and Settings\CK\Application Data\Winamp
2008-02-29 09:10 --------- d-----w C:\Program Files\Virtual CD v4
2008-02-26 10:46 --------- d-----w C:\Program Files\DivX
2008-02-26 07:03 --------- d-----w C:\Documents and Settings\CK\Application Data\Uniblue
2008-02-26 07:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Uniblue
2008-02-26 07:02 --------- d-----w C:\Program Files\Uniblue
2008-02-23 11:45 --------- d-----w C:\Program Files\EA Sports
2008-02-12 01:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-10 02:48 --------- d-----w C:\Program Files\Java
2008-02-10 02:43 --------- d-----w C:\Program Files\Common Files\Java
2008-02-03 13:45 --------- d-----w C:\Program Files\Lavasoft
2008-02-03 13:43 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-02 16:08 --------- d-----w C:\Program Files\EA GAMES
2008-02-01 02:26 262,144 ----a-w C:\ntuser.dat
2008-02-01 00:13 --------- d-----w C:\Program Files\Microsoft Works
2008-02-01 00:12 --------- d-----w C:\Program Files\MSBuild
2008-01-31 22:01 --------- d-----w C:\Program Files\Microsoft.NET
2008-01-31 22:01 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-01-31 14:06 --------- d-----w C:\Program Files\DAP
2007-07-07 10:18 8 --sha-r C:\WINDOWS\system32\522F92A07B.dll
2007-05-18 03:03 80 --sha-r C:\WINDOWS\system32\C09DD96469.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2007-12-07 13:07 1502232 --a------ C:\Program Files\Freecorder\tbFre1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612} "= "C:\Program Files\Freecorder\tbFre1.dll" [2007-12-07 13:07 1502232]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612} "= C:\Program Files\Freecorder\tbFre1.dll [2007-12-07 13:07 1502232]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"mcagent_exe "= "C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"SiteAdvisor "= "C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-25 00:57 36640]
"WinPatrol "= "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2007-08-02 19:59 292152]

C:\Documents and Settings\CK\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
--a------ 2007-11-01 19:12 582992 C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McENUI]
C:\PROGRA~1\McAfee\MHN\McENUI.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer "=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Messenger\\msmsgs.exe "=
"C:\\Program Files\\Internet Explorer\\iexplore.exe "=
"C:\\Documents and Settings\\CK\\Application Data\\SopCast\\adv\\SopAdver.exe "=
"C:\\Program Files\\SopCast\\SopCast.exe "=
"C:\\WINDOWS\\system32\\dpvsetup.exe "=
"C:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe "=
"C:\\Program Files\\SopCast\\sopvod.exe "=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe "=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"C:\\Program Files\\EA GAMES\\Need for Speed Underground 2\\speed2.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"C:\\Program Files\\FlashGet\\FlashGet.exe "=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=

R2 GLOGODrv;GLOGODrv;C:\WINDOWS\system32\drivers\GLOGODrv.sys [2000-10-13 02:16]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-11-04 15:39]
S3 WMIINFO;WMIINFO Driver;C:\WINDOWS\system32\Drivers\wmiinfo.sys [2001-10-19 00:47]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-04 12:02:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job "
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-03-24 05:14:17 C:\WINDOWS\Tasks\McDefragTask.job "
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-03-28 03:12:09 C:\WINDOWS\Tasks\MP Scheduled Scan.job "
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-02-26 07:03:36 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job "
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-02-26 06:56:08 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job "
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-02-26 07:10:28 C:\WINDOWS\Tasks\Uniblue SpyEraser.job "
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-28 06:11:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-03-28 6:17:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-28 03:17:29
Pre-Run: 17,046,700,032 bytes free
Post-Run: 16,953,671,680 bytes free
.
2008-03-26 06:25:18 --- E O F ---


And HIJACKTHIS LOG,


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:38:24 AM, on 3/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Downloads\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: (no name) - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: TweakMASTER Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TweakBHO.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://www.bpp.com/acca/study-materials/ilearn/common/activex/awswaxd.cab
O16 - DPF: {436ABEF3-3479-4703-B4A9-64268AEFFEE9} (SopCore Control) - http://www.joytopic.com/download/SOPCORE.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://download.sopcast.com/download/SOPCORE.CAB
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.mydesichannel.com/nsvplayx_vp3_mp3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9584 bytes

 

Important: Should i now enable McAfee Real-Time protection, WinPatrol & Spyware Guard considering i've already run combofix?

 

Run HijackThis and fix the following entries, then reboot and re-enable your realtime protections.

O2 - BHO: (no name) - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)


Post a fresh HijackThis log created after reboot.

I recommend removing keygen.exe if not needed.

 

Don't know whether i need it or not, but to be on the safe side i've removed "keygen.exe ". Also, when Real-Time protection was disabled, the computer seemed to be functioning a bit quicker. I've seen on my friend's computer that when MCAfee is uninstalled the startup is much quicker. Probably coz it's a memory hogger.

Here's the fresh HIJACKTHIS LOG,


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:59:20 AM, on 3/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
D:\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: TweakMASTER Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TweakBHO.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://www.bpp.com/acca/study-materials/ilearn/common/activex/awswaxd.cab
O16 - DPF: {436ABEF3-3479-4703-B4A9-64268AEFFEE9} (SopCore Control) - http://www.joytopic.com/download/SOPCORE.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by123fd.bay123.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://download.sopcast.com/download/SOPCORE.CAB
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.mydesichannel.com/nsvplayx_vp3_mp3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9435 bytes

 

Looks good.

Yes, McAfee has quite a number of processes, and it does place quite a load on the system. Windows Defender has been a culprit for some folks too.

Lets clean up a bit and run an online scan to see if we've missed anything.

Download ATF Cleaner by Atribune and save it to your Desktop.

• Double click ATF-Cleaner.exe to run the program.
• Check the boxes to the left of:
  
  
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Java Cache
  • Recycle bin
  
  
• The rest are optional - if you want it to remove everything check "Select All ".
• Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.

Reboot


I know you've already run Kaspersky WebScanner, so run it again please and once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.


Post the Kaspersky log here please.

 

First of all thank you very much for your prompt replies. Really appreciate it.

Below is the Kaspersky log. I've noticed that there's an infection (inapp6.exe) in the Flashget folder. Did a search and found that many people, who are using Flashget, have somewhat similar infection/trojan (inapp4.exe or inapp5.exe). Some think Flashget should be uninstalled till the company finds a fix.Others say, just remove the infected file.But whether uninstalling or removing, there's a chance that traces would still be left. What's wrong? Should Flashget be uninstalled? What's the safest way to uninstall/remove it, without there being any trace of it? And why wasn't it detected by the AV in the first place? It's really weird!

I know how to get to the System Volume Information folder. Should the infected files be removed/deleted?



-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, March 28, 2008 2:51:50 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/03/2008
Kaspersky Anti-Virus database records: 668190
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 125278
Number of viruses found: 7
Number of infected objects: 16
Number of suspicious objects: 0
Duration of the scan process: 04:30:29

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSK\MSKWMDB.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSK\settingsdb.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-02042008-090429.log Object is locked skipped
C:\Documents and Settings\CK\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\CK\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\CK\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\CK\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{2BBDF418-01DD-42F6-A4DE-8A61A7F16142} Object is locked skipped
C:\Documents and Settings\CK\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\CK\Local Settings\Temp\sqlite_aehwVTGqLYR5ga7 Object is locked skipped
C:\Documents and Settings\CK\Local Settings\Temp\~DFC4F7.tmp Object is locked skipped
C:\Documents and Settings\CK\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\CK\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\CK\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\DAP\History\Baby\_lasthist.dat Object is locked skipped
C:\Program Files\DAP\History\Hira\_lasthist.dat Object is locked skipped
C:\Program Files\FlashGet\inapp6.exe Infected: Trojan-Downloader.Win32.Agent.kht skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{B4BFD0C1-BEF9-4140-8CE0-8D700C9E42AB}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\mcmsc_OlTvsHCpX6faLmd Object is locked skipped
C:\WINDOWS\Temp\mcmsc_OOeMszrneEAHjjd Object is locked skipped
C:\WINDOWS\Temp\sqlite_H2LCrvpWFTSztZO Object is locked skipped
C:\WINDOWS\Temp\sqlite_UGXWdWqVaP8Gqey Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008513.exe/icF365.cab/DangerScript.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.591 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008513.exe/icF365.cab Infected: not-a-virus:Client-IRC.Win32.mIRC.591 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008513.exe ZIP: infected - 2 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008515.exe/WISE0101.BIN Infected: not-a-virus:AdWare.Win32.Web3000.b skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008515.exe WiseSFX: infected - 1 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008515.exe WiseSFXDropper: infected - 1 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008521.exe/data0006 Infected: not-a-virus:Monitor.Win32.EliteKeylogger.a skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008521.exe/data0007 Infected: not-a-virus:Monitor.Win32.EliteKeylogger.21 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008521.exe/data0009 Infected: not-a-virus:Monitor.Win32.EliteKeylogger.21 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008521.exe/data0010 Infected: not-a-virus:Monitor.Win32.EliteKeylogger.30 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008521.exe/data0012 Infected: not-a-virus:Monitor.Win32.EliteKeylogger.21 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008521.exe NSIS: infected - 5 skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008527.exe/stream/data0024 Infected: not-a-virus:AdWare.Win32.Mostofate.ab skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008527.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.ab skipped
D:\System Volume Information\_restore{2307EBC5-2358-4411-A91C-3BA7596B7F8C}\RP14\A0008527.exe NSIS: infected - 2 skipped

Scan process completed.

 

The inapp6.exe file definitely needs to be removed. I personally recommend removing FlashGet, though that is your option. If you choose to keep it, please uninstall the current installation, re-download and re-install. I also recommend you read this link prior to making your decision. Draw your own conclusion from the following statement in the next to last paragraph.

Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.

That should wrap things up. Everything seem to be working properly again?

 

10 days!! What were the developers doing!!. Caused a lot of mess to a lot many people. Anyways, i've successfully removed/uninstalled Flashget from the computer. Could you suggest a better, or rather a safer, download manager/accelerator?

Ran uninstallation of Combofix. McAfee alters or asks permission to trust or not;

"Potentially Unwanted Program "
Name: RemAdm-ProcLaunch!171
Location: C:\327882R2FWJFW\psexec.cfexe

I allowed it. Was it ok? Now Combofix is uninstalled and the Restore Points set.

I'd also like to inform you that i had turned off System Restore a month or so ago due to the detection of vundos, as i had mentioned in my earlier post. Should i turn them back on again?

 

psexec.cfexe is safe, and may have been uninstalled along with ComboFix.

As noted, uninstalling ComboFix reset System Restore, meaning all old restore points have been removed. If System Restore is still disabled, I do recommend you re-enable it.

I've had Metaproducts Download Express for quite a long time now and have experienced no issues with it. Might want to give it a try.

Your computer is now clean! Geri has posted some very helpful information and recommendations regarding future protection in the following link.

http://www.windowsbbs.com/showthread.php?t=67958

Surf safe!

 

Yes, System Restore is enabled. I'll probably give Metaproducts Download Express a try.

In the end , i'd just like to thank you for all your time & effort. And the continued help & support you've given in the past few days in resolving the issue(s). You guys are doing a great job. Keep up the good work.

Thanks again.


Regards,

Shadowdancer

 

You're most welcome. Glad I could help.