Need your suggestions!

[vakar]

Hi Chryssi
hope you are OK.
I started my pc in Safe Mode. I ran hijackthis and there was the line. I fixed it as you said. And then ran the combofix. Here is the report:

ComboFix 08-02-17.2 - KRBLK 2008-02-20 1:54:34.10 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1254.1.1055.18.1782 [GMT 2:00]
Running from: C:\Documents and Settings\KRBLK\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\KRBLK\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Administrator\Desktop\KRBK1\Desktop\davcln.dll
C:\Documents and Settings\KRBK\Local Settings\Temp\pbquvxlz.dat
C:\WINDOWS\system32\drivers\gdeydjhjsxcb.sys
C:\WINDOWS\system32\drivers\swxvpsqf.dat
D:\1 VAHAP\DOWNLOADS\sUBAT08\SmitfraudFix.exe
D:\1 VAHAP\DOWNLOADS\sUBAT08\SmitfraudFix.zip
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Desktop\KRBK1\Desktop\davcln.dll
C:\WINDOWS\system32\drivers\gdeydjhjsxcb.sys
C:\WINDOWS\system32\drivers\swxvpsqf.dat . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-17 01:12 . 2008-02-17 01:12 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-17 01:12 . 2008-02-17 01:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-16 23:07 . 2008-02-16 23:42 <DIR> d-------- C:\Program Files\AirTies
2008-02-16 23:07 . 2008-02-16 23:07 <DIR> d-------- C:\Documents and Settings\KRBLK\Application Data\InstallShield
2008-02-16 23:07 . 2007-03-16 12:53 450,944 --a------ C:\WINDOWS\system32\drivers\TUSB1150.sys
2008-02-16 23:07 . 2006-12-04 15:42 97,388 --a------ C:\WINDOWS\system32\drivers\Fwusb1b.bin
2008-02-16 23:07 . 2007-03-16 14:42 69,632 --a------ C:\WINDOWS\system32\TnetWCoInst.dll
2008-02-12 21:56 . 2008-02-12 21:56 <DIR> d-------- C:\Program Files\Ares
2008-02-12 21:30 . 2008-02-12 21:30 <DIR> d-------- C:\Documents and Settings\KRBLK\Application Data\Nero
2008-02-11 14:01 . 2008-02-11 14:01 <DIR> d---s---- C:\Documents and Settings\KRBLK\UserData
2008-02-10 13:20 . 2008-02-13 02:18 <DIR> d-------- C:\Documents and Settings\KRBLK\Contacts
2008-02-10 12:40 . 2004-08-04 09:45 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-10 12:39 . 2008-02-19 23:01 <DIR> d-------- C:\Documents and Settings\KRBLK\Sk Kullanlanlar
2008-02-10 12:39 . 2008-02-19 20:23 <DIR> d-------- C:\Documents and Settings\KRBLK\Belgelerim
2008-02-10 04:50 . 2008-02-10 04:50 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-02-08 04:29 . 2008-02-20 01:50 <DIR> d-------- C:\Hijack
2008-02-08 04:06 . 2008-02-08 04:06 19,584 --a------ C:\WINDOWS\system32\drivers\swxvpsqf.dat
2008-02-07 03:08 . 2008-02-07 03:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Locktime
2008-02-06 13:26 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-02-06 11:11 . 2008-02-06 13:43 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-06 11:11 . 2008-02-06 13:25 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-06 11:11 . 2008-02-06 13:25 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-06 11:11 . 2008-02-06 13:25 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-06 11:04 . 2008-02-06 11:04 <DIR> d-------- C:\Program Files\CCleaner
2008-01-28 13:27 . 2008-02-08 03:43 <DIR> d-------- C:\Program Files\The Privacy Guard
2008-01-28 05:42 . 2008-01-30 01:32 32 --a------ C:\WINDOWS\go
2008-01-27 00:00 . 2008-01-27 00:00 <DIR> d-------- C:\WINDOWS\Sun
2008-01-26 23:30 . 2008-01-26 23:30 <DIR> d-------- C:\Program Files\Webroot
2008-01-26 23:30 . 2008-01-26 23:30 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2008-01-26 23:30 . 2008-01-26 23:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2008-01-26 23:30 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll
2008-01-26 23:30 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2008-01-26 23:30 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2008-01-26 23:30 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2008-01-26 23:30 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2008-01-25 03:12 . 2008-01-25 03:14 <DIR> d-------- C:\Documents and Settings\Administrator\Sk Kullanlanlar
2008-01-25 03:12 . 2007-12-25 21:57 <DIR> d-------- C:\Documents and Settings\Administrator\Belgelerim
2008-01-25 01:20 . 2008-01-25 01:20 <DIR> d-------- C:\NVIDIA
2008-01-25 01:20 . 2007-12-17 13:53 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-01-25 01:09 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-25 00:56 . 2008-01-25 00:56 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-01-25 00:50 . 2008-01-25 00:58 127,254 --a------ C:\WINDOWS\system32\nvapps.xml
2008-01-25 00:50 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-01-25 00:50 . 2007-06-29 00:43 17,254 --a------ C:\WINDOWS\system32\nvwsapps.xml
2008-01-23 00:40 . 2008-02-06 13:37 <DIR> d-------- C:\Program Files\MagicTune Premium
2008-01-23 00:40 . 2007-11-23 19:19 13,056 --a------ C:\WINDOWS\system32\drivers\MTiCtwl.sys
2008-01-19 04:02 . 2008-02-06 13:39 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-01-19 04:02 . 2008-02-11 23:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-19 02:49 . 2008-01-19 02:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-19 02:20 . 2008-02-06 13:34 <DIR> d-------- C:\Program Files\Bonjour
2008-01-19 02:12 . 2008-01-19 02:12 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-16 21:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-08 01:42 --------- d-----w C:\Program Files\FlashGet
2008-02-06 11:38 --------- d-----w C:\Program Files\MSN Messenger
2008-02-06 11:32 --------- d-----w C:\Program Files\a-squared Anti-Malware
2008-02-06 09:32 --------- d-----w C:\Program Files\TrojanHunter 5.0
2008-02-06 09:32 --------- d-----w C:\Program Files\BatchPhoto
2008-01-24 23:09 --------- d-----w C:\Program Files\Java
2008-01-19 00:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-17 22:19 --------- d-----w C:\Program Files\Business Objects
2008-01-14 23:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-13 00:55 --------- d-----w C:\Program Files\Avira
2008-01-13 00:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-01-13 00:25 --------- d-----w C:\Program Files\Common Files\snp2std
2008-01-13 00:20 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-01-13 00:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-13 00:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-12 21:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-01-12 01:01 --------- d-----w C:\Program Files\Lavasoft
2008-01-11 15:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-01-11 14:52 --------- d-----w C:\Program Files\Common Files\Java
2008-01-11 14:47 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-09 06:41 --------- d-----w C:\Program Files\SmartDraw 2008
2008-01-08 19:41 --------- d-----w C:\Program Files\Xara
2008-01-08 16:01 --------- d-----w C:\Program Files\Eltima Software
2008-01-04 02:09 --------- d-----w C:\Program Files\GVZ
2008-01-04 01:53 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-03 00:14 --------- d-----w C:\Program Files\iFoxSoft
2008-01-02 21:59 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-01-02 21:58 --------- d-----w C:\Program Files\Macromedia
2007-12-30 00:38 --------- d-----w C:\Program Files\Winamp
2007-12-30 00:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\SRS Labs
2007-12-30 00:11 --------- d-----w C:\Program Files\SRS Labs
2007-12-29 23:56 --------- d-----w C:\Program Files\Acon Digital Media
2007-12-29 21:02 --------- d-----w C:\Program Files\Common Files\Nero
2007-12-29 21:01 --------- d-----w C:\Program Files\Nero
2007-12-29 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-12-29 15:08 --------- d-----w C:\Program Files\ABBYY FineReader 7.0 Professional Edition
2007-12-29 15:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\ABBYY
2007-12-29 02:02 --------- d-----w C:\Program Files\Hewlett-Packard
2007-12-27 22:07 --------- d-----w C:\Program Files\Alcohol Soft
2007-12-27 22:06 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-27 21:50 --------- d-----w C:\Program Files\Microsoft Games
2007-12-26 22:40 --------- d-----w C:\Program Files\DIFX
2007-12-26 12:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-26 09:23 --------- d-----w C:\Program Files\Common Files\SWF Studio
2007-12-25 21:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-12-25 20:33 --------- d-----w C:\Program Files\MSBuild
2007-12-25 20:33 --------- d-----w C:\Program Files\Microsoft Works
2007-12-25 20:10 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-12-25 20:10 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2007-12-25 19:46 315,392 ----a-w C:\WINDOWS\HideWin.exe
2007-12-25 19:46 --------- d-----w C:\Program Files\Realtek
2007-12-25 19:26 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-13 17:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-12-05 00:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-12-03 16:04 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:45 15360]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-12-31 16:29 962560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-06 10:50 16855552 C:\WINDOWS\RTHDCPL.exe]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-13 02:59 249896]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-01-07 17:56 1816208]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 09:45 33280 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 09:45 33280 C:\WINDOWS\system32\rundll32.exe]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-09-15 13:21 675840]
"AirTiesWUS-300"="C:\Program Files\AirTies\AirTiesWUS-300\WUS300.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:45 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programlar^Başlangıç^Adobe Reader Hızlı Çalıştırma.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programlar\Başlangıç\Adobe Reader Hızlı Çalıştırma.lnk
backup=C:\WINDOWS\pss\Adobe Reader Hızlı Çalıştırma.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programlar^Başlangıç^GammaTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programlar\Başlangıç\GammaTray.lnk
backup=C:\WINDOWS\pss\GammaTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^KRBK^Start Menu^Programlar^Başlangıç^Adobe Gamma.lnk]
path=C:\Documents and Settings\KRBK\Start Menu\Programlar\Başlangıç\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^KRBK^Start Menu^Programlar^Başlangıç^OneNote 2007 Ekran Kırpıcı ve Başlatıcı.lnk]
path=C:\Documents and Settings\KRBK\Start Menu\Programlar\Başlangıç\OneNote 2007 Ekran Kırpıcı ve Başlatıcı.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Ekran Kırpıcı ve Başlatıcı.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2006-11-20 06:00 116096 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
--a------ 2007-12-31 16:29 962560 C:\Program Files\Ares\Ares.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro]
--a------ 2004-12-17 00:38 290816 C:\Program Files\ABBYY FineReader 7.0 Professional Edition\ABBYYNewsReader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 2007-02-12 14:50 20480 C:\WINDOWS\FixCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 00:57 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-12-03 14:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std]
--a------ 2006-09-15 13:21 675840 C:\WINDOWS\vsnp2std.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
--a------ 2008-01-04 20:56 5367664 C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp2std]
C:\WINDOWS\tsnp2std.exe

R3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2007-01-26 16:48]
S3 TUSB1150;Airties WUS-300 USB Wireless Adapter (TNETW1450);C:\WINDOWS\system32\DRIVERS\tusb1150.sys [2007-03-16 12:53]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-19 23:57:00 C:\WINDOWS\Tasks\SDMsgUpdate (TE).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://www.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X
"2008-01-28 00:00:01 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job"
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe&/ScheduleSweep=wrSpySweeperTrialSweep
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.ex
- C:\
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 01:57:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MagicTune Premium\MagicTune.exe
.
**************************************************************************
.
Completion time: 2008-02-20 1:58:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-19 23:58:40
ComboFix2.txt 2008-02-17 02:26:13
ComboFix3.txt 2008-02-12 23:51:05
ComboFix4.txt 2008-02-11 22:04:46
ComboFix5.txt 2008-02-08 02:22:07


============================================================================================

And here is my new Kasperky report:

KASPERSKY ONLINE SCANNER REPORT
Wednesday, February 20, 2008 3:07:48 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/02/2008
Kaspersky Anti-Virus database records: 573314


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\

Scan Statistics
Total number of scanned objects 88100
Number of viruses found 2
Number of infected objects 9
Number of suspicious objects 0
Duration of the scan process 01:00:28

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\525e95cf1897386e7b855260b2418dd4_02bfd050-1b7e-459d-a3d7-5b9d8e893fd7 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6da6eea72eb23442f488b08faaa028bd_02bfd050-1b7e-459d-a3d7-5b9d8e893fd7 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b713a22cd213e29d456565d28e20a944_02bfd050-1b7e-459d-a3d7-5b9d8e893fd7 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Nero\Nero8\OnlineServices\usagestats.bin Object is locked skipped

C:\Documents and Settings\KRBLK\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\KRBLK\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\KRBLK\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\KRBLK\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\KRBLK\Local Settings\History\History.IE5\MSHist012008022020080221\index.dat Object is locked skipped

C:\Documents and Settings\KRBLK\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\KRBLK\ntuser.dat Object is locked skipped

C:\Documents and Settings\KRBLK\NtUser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Hijack\backups\backup-20080213-014145-542.dll Object is locked skipped

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2008-02-20.01-57-12.log Object is locked skipped

C:\Program Files\Nero\Nero8\Nero BackItUp\BIU1.txt Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped

C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped

C:\QooBox\Quarantine\C\Documents and Settings\Administrator\Desktop\KRBK1\Desktop\davcln.dll.vir Object is locked skipped

C:\QooBox\Quarantine\C\WINDOWS\system32\davcln.dll.vir Object is locked skipped

C:\QooBox\Quarantine\catchme2008-02-13_ 14910.42.zip/swxvpsqf.dat Infected: Rootkit.Win32.Agent.aap skipped

C:\QooBox\Quarantine\catchme2008-02-13_ 14910.42.zip ZIP: infected - 1 skipped

C:\QooBox\Quarantine\catchme2008-02-20_ 15710.87.zip/swxvpsqf.dat Infected: Rootkit.Win32.Agent.aap skipped

C:\QooBox\Quarantine\catchme2008-02-20_ 15710.87.zip ZIP: infected - 1 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{BD7DE5B0-3D3B-4CEC-B1F9-02ACD7017FF6}\RP11\A0001583.VIR Object is locked skipped

C:\System Volume Information\_restore{BD7DE5B0-3D3B-4CEC-B1F9-02ACD7017FF6}\RP16\A0001916.dll Object is locked skipped

C:\System Volume Information\_restore{BD7DE5B0-3D3B-4CEC-B1F9-02ACD7017FF6}\RP16\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\ActiveScan\pskavs.dll Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped

C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\NetLimit.evt Object is locked skipped

C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped

C:\WINDOWS\system32\config\OSession.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\drivers\swxvpsqf.dat Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\1 VAHAP\DOWNLOADS\şUBAT08\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

D:\1 VAHAP\DOWNLOADS\şUBAT08\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

D:\1 VAHAP\DOWNLOADS\şUBAT08\SmitfraudFix.exe RarSFX: infected - 2 skipped

D:\1 VAHAP\DOWNLOADS\şUBAT08\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

D:\1 VAHAP\DOWNLOADS\şUBAT08\SmitfraudFix.zip ZIP: infected - 1 skipped

Thanks for your help. Hope we have solved it this time. Take care

[sUBs]

Hello vakar, my name is sUBs. Chryssi asked me to come have a look at your stubborn infection.

C:\WINDOWS\system32\drivers\swxvpsqf.dat

From what Kaspersky is telling us, this file appears to be sole remaining thorn in your side.
Please do me a favor & go to the directory - C:\WINDOWS\system32\drivers\
Right click on swxvpsqf.dat, & select "Delete"
If Windows throws up an error message, please tell me what it says


---------


In addition to the above, I would like for you to install the Recovery Console onto this machine. Further instructions may be found from this link ==> http://www.bleepingcomputer.com/combofi ... e-combofix


--------


After making your reply, please try to hang around for a while. I'm usually online & shall be able to respond to you quite fast

[vakar]

Hello sUBs,
thanks for your helps both. I did what you told. When I deleted it gave no message. Just wait for a few seconds and then deleted.

Is it still infected after all we did. What a stubborn malware is this. Actually it doesn't disturb me anymore after the helps of Chryssi. But I will wait for your further advices.
Thanks

[sUBs]

In that case, we needn't take any further actions. Chryssi will be along shortly

[chryssi2001]

Hello vakar ,

I am glad at last that bad file left.
---------------------------------------
There are some tools in your D:\ drive.
I want you to go mannually there and remove them.

Using Windows Explore by right-clicking the Start button and left clicking Explore navigate to and find the following files:

D:\1 VAHAP\DOWNLOADS\sUBAT08\SmitfraudFix.exe
D:\1 VAHAP\DOWNLOADS\sUBAT08\SmitfraudFix.zip

Right-Click and remove them.
---------------------------------------
Please post back a new HijackThis log.

[vakar]

Hi! Chryssi,
the file Smitfraud is a kind of Spy remover. I think you have already known this. Does it really necessary if you say yes I will delete it.
Best wishes.

[chryssi2001]

Hello vakar,

the file Smitfraud is a kind of Spy remover. I think you have already known this. Does it really necessary if you say yes I will delete it.

It's not a plain Spy remover.
Smifraud deals with a special infection.
I don't find the reason you should keep it on your pc. It doesn't deal with other infections.

When we finish cleaning a computer we tend to remove all the tools we've used. Some tools are dangerous if used from untrained people.

I don't know if you used Smitfraud before, when you had the certain infection, or its a leftover when someone helped you to deal with Smitfraud, but this is a warning we give when we use this tool:
Warning : running option #2 on a non infected computer will remove your Desktop background.

Having these in mind i will let you decide.
---------------------------------
Now i need a last HijackThis log, just to confirm that everything is ok, and that line we removed left for good, so i can let you go.

[vakar]

Hi Chryssi

As you said I deleted Smitfraud. I kept it because as I told before I am interested in learning spywares and malwares. I want to know how they work and how they infect what programs they ruin and else....

I don't have much time now. As soon as I am at ease I will study on spywares and malwares. I will join Malware University that you told me before.

Well here is my last Hijackthis log file.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:23:19, on 26.02.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\vsnp2std.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AirTies\ADSL Hizmet Programı\AirTies_util3.exe
C:\Program Files\MagicTune Premium\MagicTune.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\KRBLK\Desktop\Okey 34 51 101.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Hijack\Analyze.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [AirTiesWUS-300] C:\Program Files\AirTies\AirTiesWUS-300\WUS300.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AirTies ADSL Hizmet Programı.lnk = ?
O8 - Extra context menu item: Microsoft Excel'e &Ver - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab2.cab
O16 - DPF: {6F0892F7-0D44-41C3-BF07-7599873FAA04} (Crystal ActiveX Report Viewer Control 11.5) - http://reporteokul.meb.gov.tr/crystalre ... viewer.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 7041 bytes

Thank you very much!

[chryssi2001]

Hello vakar ,

As you said I deleted Smitfraud. I kept it because as I told before I am interested in learning spywares and malwares. I want to know how they work and how they infect what programs they ruin and else....
I don't have much time now. As soon as I am at ease I will study on spywares and malwares. I will join Malware University that you told me before.

You did well. Better not keep a tool, which you don't know how to use and can prove dangerous for your pc.
You are welcome to join the University any time!
---------------------------------------------
Now back to your log.

I can see a new process on your pc. My searches ended to Turkish language links which unfortunately i can't understand.
Please inform me if you know what the below process is. Does it belong to any new program you downloaded? If yes please tell me the program name.

C:\Documents and Settings\KRBLK\Desktop\Okey 34 51 101.exe

If you are not sure what it is please upload it, and post back the results with a new HijackThis log.
---------------------------------------------
Upload a File to Jotti
Please visit http://virusscan.jotti.org/

Copy/paste this file and path into the white box at the top:

C:\Documents and Settings\KRBLK\Desktop\Okey 34 51 101.exe

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.
---------------------------------------------
Update Java Runtime:

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 4.

• Go to http://java.sun.com/javase/downloads/index.jsp
  
• Go to Java Runtime Environment (JRE) 6 Update 4 and click on Download button.
• In Platform box choose Windows.
• Check the box to Accept License Agreement and click Continue.
• Click on Windows Offline Installation, click on the link under it which says "jre-6u4-windows-i586-p.exe" and save the downloaded file to your desktop.
• Go to Start => Control Panel => Add or Remove Programs
• Uninstall all old versions of Java (Java 3 Runtime Environment, JRE or JSE)
• Reboot your computer
• Delete the folder C:\Program Files\Java if present
• Install the new version by running the newly-downloaded file with the java icon which will be at your desktop, and follow the on-screen instructions.
• Reboot your computer

---------------------------------------------
I can't see any firewall in your HijackThis log, so i assume you use windows firewall.

FIREWALL
Without a firewall your computer is susceptible to being hacked and taken over. If you use the Windows Firewall you might think that's sufficient but it only controls one way of the traffic (inbound). Simply using a Firewall in its default configuration can lower your risk greatly. It's preferable to install one of the suggested firewalls.

FREE FIREWALLS

• Comodo
• Outpost
• Sunbelt Kerio

Tutorial about Firewalls can be found here
---------------------------------------------
Post back:
Information of java results about C:\Documents and Settings\KRBLK\Desktop\Okey 34 51 101.exe
A new HijackThis log.

[vakar]

Hi Chryssi

As you said I updated java It's now jre-6u4

And the file you asked -Okey 34 51 101.exe
It is not something really important. It belongs to a game site. It is relaible. Well I uploaded to jotti but nothing found

As you wish I am using Comodo firewall now. It is learning fast

And here is my new Hijackthis log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:39:45, on 29.02.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AirTies\ADSL Hizmet Programı\AirTies_util3.exe
C:\Program Files\MagicTune Premium\MagicTune.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Hijack\Analyze.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [AirTiesWUS-300] C:\Program Files\AirTies\AirTiesWUS-300\WUS300.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AirTies ADSL Hizmet Programı.lnk = ?
O8 - Extra context menu item: Microsoft Excel'e &Ver - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab2.cab
O16 - DPF: {6F0892F7-0D44-41C3-BF07-7599873FAA04} (Crystal ActiveX Report Viewer Control 11.5) - http://reporteokul.meb.gov.tr/crystalre ... viewer.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 7500 bytes

Take care

PS: I hope I am good at doing what you asked me to do

[chryssi2001]

Hello vakar ,

I thought you've forgotten me

And the file you asked -Okey 34 51 101.exe
It is not something really important. It belongs to a game site. It is relaible. Well I uploaded to jotti but nothing found

Good!

As you wish I am using Comodo firewall now. It is learning fast

I am using Comodo too and am very happy with it.

PS: I hope I am good at doing what you asked me to do

You did great in every step i asked you to do!
----------------------------------------------------
Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
• 

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

----------------------------------------------------
Congratulations you are clean!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.5.2
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here
Find here changes from older version 1.4 here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.

Happy safe surfing!

[Elrond]

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.