This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

c://windows/explorer.exe Virus BDS/Small.iuj

9 min read

This thread's last reply is from February 27, 2010, 3:41 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Platform: Windows XP SP2
Boot mode: Normal

ComboFix 10-02-26.02 - 27.02.2010 9:50.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.758 [GMT 2:00]
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\desktop.ini

.
((((((((((((((((((((((((( Files Created from 2010-01-27 to 2010-02-27 )))))))))))))))))))))))))))))))
.

2010-02-26 20:58 . 2010-02-26 20:58 -------- d-----w- c:\documents and settings\Pufix\Local Settings\Application Data\ACDSee
2010-02-26 20:58 . 2010-02-26 20:58 -------- d-----w- c:\documents and settings\Pufix\Application Data\ACD Systems
2010-02-26 20:53 . 2010-02-26 20:53 -------- d-----w- c:\documents and settings\Pufix\Local Settings\Application Data\Yahoo
2010-02-26 20:53 . 2010-02-26 20:53 -------- d-----w- c:\documents and settings\Pufix\Application Data\Yahoo!
2010-02-26 20:47 . 2010-02-26 20:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-02-26 20:47 . 2009-11-10 12:39 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2010-02-26 20:29 . 2010-02-27 06:52 -------- d-----w- c:\documents and settings\Pufix\Application Data\skypePM
2010-02-26 20:29 . 2010-02-26 20:29 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-02-26 20:26 . 2010-02-27 06:52 -------- d-----w- c:\documents and settings\Pufix\Application Data\Skype
2010-02-26 20:26 . 2010-02-26 20:26 -------- d-----w- c:\program files\Common Files\Skype
2010-02-26 20:26 . 2010-02-26 20:26 -------- d-----r- c:\program files\Skype
2010-02-26 20:26 . 2010-02-26 20:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-02-26 17:39 . 2008-03-21 11:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-02-26 17:39 . 2008-03-21 11:57 23856 ----a-w- c:\windows\system32\spupdsvc.exe
2010-02-26 17:38 . 2010-02-26 17:40 -------- d-----w- c:\documents and settings\Pufix\Application Data\Nokia
2010-02-26 17:38 . 2010-02-26 17:40 -------- d-----w- c:\documents and settings\Pufix\Application Data\PC Suite
2010-02-26 17:38 . 2010-02-26 17:38 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2010-02-26 17:37 . 2010-02-26 17:37 -------- d-----w- c:\program files\DIFX
2010-02-26 17:37 . 2008-08-26 07:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2010-02-26 17:37 . 2010-02-26 17:37 -------- d-----w- c:\program files\PC Connectivity Solution
2010-02-26 17:37 . 2010-02-26 20:29 -------- dc----w- c:\windows\system32\DRVSTORE
2010-02-26 17:37 . 2008-09-15 05:56 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2010-02-26 17:37 . 2010-02-26 20:30 -------- d-----w- c:\program files\Nokia
2010-02-26 15:33 . 2010-02-26 15:33 -------- d-----w- c:\documents and settings\Pufix\Local Settings\Application Data\Apple Computer
2010-02-26 15:15 . 2010-02-26 15:15 -------- d-----w- c:\documents and settings\Pufix\Local Settings\Application Data\Ahead
2010-02-26 15:13 . 2010-02-26 15:13 -------- d-----w- c:\documents and settings\Pufix\Application Data\Ahead
2010-02-26 15:10 . 2010-02-26 15:13 -------- d-----w- c:\program files\Common Files\Ahead
2010-02-26 15:10 . 2010-02-26 15:10 -------- d-----w- c:\program files\Nero
2010-02-26 15:05 . 2002-11-04 03:50 545 ----a-w- c:\windows\UC.PIF
2010-02-26 15:05 . 2002-11-04 03:50 545 ----a-w- c:\windows\RAR.PIF
2010-02-26 15:05 . 2002-11-04 03:50 545 ----a-w- c:\windows\PKZIP.PIF
2010-02-26 15:05 . 2002-11-04 03:50 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-02-26 15:05 . 2002-11-04 03:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-02-26 15:05 . 2002-11-04 03:50 545 ----a-w- c:\windows\LHA.PIF
2010-02-26 15:05 . 2002-11-04 03:50 545 ----a-w- c:\windows\ARJ.PIF
2010-02-26 15:05 . 2010-02-26 15:06 -------- d-----w- C:\totalcmd
2010-02-26 15:04 . 2010-02-26 15:05 -------- d-----w- c:\documents and settings\Pufix\Application Data\BSplayer Pro
2010-02-26 15:04 . 2010-02-26 15:04 -------- d-----w- c:\program files\Webteh
2010-02-26 15:03 . 2010-02-26 15:03 -------- d-----w- c:\program files\AC3Filter
2010-02-26 15:03 . 2010-02-26 15:03 -------- d-----w- c:\program files\Crystal Player
2010-02-26 15:03 . 2010-02-26 15:03 -------- d-----w- c:\program files\DivX
2010-02-26 15:02 . 2010-02-26 15:02 -------- d-----w- c:\program files\Xvid
2010-02-26 15:02 . 2010-02-26 15:03 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2010-02-26 15:02 . 2010-02-26 15:02 -------- d-----w- c:\program files\Common Files\ACD Systems
2010-02-26 15:02 . 2010-02-26 15:02 -------- d-----w- c:\program files\ACD Systems
2010-02-26 15:02 . 2009-05-01 18:52 33642704 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia PC Suit Nou.exe
2010-02-26 15:01 . 2010-02-26 15:01 -------- d-----w- c:\windows\Downloaded Installations
2010-02-26 15:01 . 2010-02-26 15:01 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe
2010-02-26 15:01 . 2010-02-26 15:01 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-02-26 15:01 . 2010-02-26 15:01 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe
2010-02-26 15:01 . 2010-02-26 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2010-02-26 15:01 . 2010-02-26 15:01 -------- d-----w- c:\program files\Alex's Software
2010-02-26 15:00 . 2010-02-26 15:00 -------- d-----w- c:\program files\oDC
2010-02-26 14:45 . 2010-02-26 17:21 404737 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2010-02-26 14:45 . 2009-04-09 08:20 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updaterc.dll
2010-02-26 14:45 . 2009-02-27 09:59 8961 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updguirc.dll
2010-02-26 14:45 . 2009-02-24 11:16 117505 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updgui.dll
2010-02-26 14:45 . 2009-02-13 14:01 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updext.dll
2010-02-26 14:45 . 2010-02-26 17:21 345345 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.dll
2010-02-26 14:45 . 2008-12-05 09:32 126721 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2010-02-26 14:29 . 2010-02-26 17:23 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-02-26 14:29 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-02-26 14:29 . 2009-02-13 10:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-02-26 14:29 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-02-26 14:29 . 2010-02-26 14:29 -------- d-----w- c:\program files\Avira
2010-02-26 14:29 . 2010-02-26 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-02-26 14:21 . 2010-02-26 20:47 -------- d-----w- c:\program files\Yahoo!
2010-02-26 14:09 . 2010-02-26 14:09 -------- d-----w- c:\windows\Sun
2010-02-26 14:08 . 2010-02-26 14:08 -------- d-----w- c:\program files\Common Files\Java
2010-02-26 14:05 . 2010-02-26 14:05 348160 ----a-w- c:\documents and settings\Pufix\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-17efd9f8-n\msvcr71.dll
2010-02-26 14:05 . 2010-02-26 14:05 503808 ----a-w- c:\documents and settings\Pufix\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-17efd9f8-n\msvcp71.dll
2010-02-26 14:05 . 2010-02-26 14:05 61440 ----a-w- c:\documents and settings\Pufix\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6d25dd9d-n\decora-sse.dll
2010-02-26 14:05 . 2010-02-26 14:05 499712 ----a-w- c:\documents and settings\Pufix\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-17efd9f8-n\jmc.dll
2010-02-26 14:05 . 2010-02-26 14:05 12800 ----a-w- c:\documents and settings\Pufix\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6d25dd9d-n\decora-d3d.dll
2010-02-26 14:03 . 2010-02-26 13:58 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-26 13:58 . 2010-02-26 13:58 -------- d-----w- c:\program files\Java
2010-02-26 12:41 . 2010-02-26 14:09 -------- d-----w- c:\documents and settings\Pufix\Application Data\foobar2000
2010-02-26 12:40 . 2010-02-26 12:41 -------- d-----w- c:\program files\foobar2000
2010-02-25 21:26 . 2010-02-25 21:26 -------- d-----w- c:\program files\Realtek Sound Manager
2010-02-25 21:26 . 2010-02-25 21:26 -------- d-----w- c:\program files\AvRack
2010-02-25 21:26 . 2002-11-21 07:07 765952 ----a-w- c:\windows\system\crlds3d.dll
2010-02-25 21:26 . 2002-08-27 08:23 720896 ----a-w- c:\windows\system32\Audio3D.dll
2010-02-25 21:26 . 2002-08-27 08:23 720896 ----a-w- c:\windows\system32\a3d.dll
2010-02-25 21:26 . 2003-08-14 15:16 404736 ----a-w- c:\windows\system32\drivers\ALCXSENS.SYS
2010-02-25 21:26 . 2003-08-15 07:53 462684 ----a-w- c:\windows\system32\drivers\ALCXWDM.SYS
2010-02-25 21:26 . 2003-08-15 07:34 57344 ----a-w- c:\windows\SOUNDMAN.EXE
2010-02-25 21:26 . 2003-07-03 04:54 208896 ------w- c:\windows\alcupd.exe
2010-02-25 21:26 . 2003-07-17 07:09 139264 ------w- c:\windows\alcrmv.exe
2010-02-25 21:25 . 2001-08-23 19:03 25434 ----a-w- c:\windows\system32\drivers\RTL8139.sys
2010-02-25 21:25 . 2010-02-25 21:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-25 21:25 . 2010-02-25 21:25 -------- d-----w- c:\windows\OPTIONS
2010-02-25 21:25 . 2010-02-25 21:25 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-25 21:25 . 2010-02-25 21:25 -------- d-----w- c:\program files\Gigabyte
2010-02-25 21:24 . 1998-10-29 14:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-02-25 21:23 . 2010-02-25 21:23 -------- d-----w- c:\documents and settings\Pufix\WINDOWS
2010-02-25 20:30 . 2010-02-25 20:31 -------- d-----w- c:\documents and settings\Pufix\Local Settings\Application Data\Adobe
2010-02-25 19:28 . 2010-02-26 14:25 -------- d-----w- c:\windows\system32\CatRoot_bak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-26 17:39 . 2010-02-26 17:39 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2010-02-26 17:39 . 2010-02-26 17:39 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-02-26 16:53 . 2010-02-25 18:44 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-26 14:25 . 2010-02-25 17:14 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2010-02-26 14:25 . 2010-02-25 17:13 -------- d-----w- c:\program files\Common Files\BitDefender
2010-02-25 18:57 . 2010-02-25 18:57 0 ----a-w- c:\windows\nsreg.dat
2010-02-25 18:55 . 2010-02-25 18:55 15544 ----a-w- c:\documents and settings\Pufix\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-25 18:51 . 2010-02-25 18:51 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-02-25 18:47 . 2010-02-25 18:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-02-25 18:46 . 2010-02-25 18:46 -------- d-----w- c:\program files\QuickTime Alternative
2010-02-25 18:46 . 2010-02-25 18:46 107132 ----a-w- c:\windows\UninstallFirefox.exe
2010-02-25 18:46 . 2010-02-25 18:46 2293 ----a-w- c:\windows\mozver.dat
2010-02-25 18:46 . 2010-02-25 18:46 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-25 18:41 . 2010-02-25 18:41 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-02-25 18:40 . 2010-02-25 18:40 -------- d-----w- c:\program files\Unlocker
2010-02-25 18:36 . 2010-02-25 18:36 -------- d-----w- c:\program files\MSN Messenger
2010-02-25 17:14 . 2010-02-25 17:14 -------- d-----w- c:\program files\BitDefender
2010-02-25 17:12 . 2010-02-25 17:12 118375 ----a-w- c:\windows\system32\aaQj_-6n09kJ.exe
2010-02-25 17:09 . 2010-02-25 17:00 -------- d-----w- c:\documents and settings\Pufix\Application Data\uTorrent
2010-02-25 17:00 . 2010-02-25 17:00 -------- d-----w- c:\program files\uTorrent
2010-02-18 08:44 . 2010-02-18 08:44 1286144 ----a-w- c:\windows\system32\-M2T_P_8.dll
.

------- Sigcheck -------

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3qfe\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3gdr\tcpip.sys
[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2gdr\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2qfe\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\tcpip.sys
[-] 2006-01-13 . 2A4818AEA80ACD2C95D7D92D2F3155F8 . 360448 . . [5.1.2600.2688] . . c:\windows\system32\drivers\tcpip.sys

[-] 2009-08-04 . 8415D9C7C050E7022AED8ABF281BE4A6 . 2189184 . . [5.1.2600.5857] . . c:\windows\SoftwareDistribution\Download\8fa1ad7968e63408057364ad07aa482c\SP3GDR\ntoskrnl.exe
[-] 2009-08-04 . D6B537A639D623ED85B73AF3E3BE4B94 . 2180352 . . [5.1.2600.3610] . . c:\windows\SoftwareDistribution\Download\8fa1ad7968e63408057364ad07aa482c\SP2GDR\ntoskrnl.exe
[-] 2009-08-04 . FDE779EA1A564EBFE16F4E0F82B61BAD . 2189312 . . [5.1.2600.5857] . . c:\windows\SoftwareDistribution\Download\8fa1ad7968e63408057364ad07aa482c\SP3QFE\ntoskrnl.exe
[-] 2009-08-04 . 8DF112C341425F29DB4566B8D2A96A7F . 2185984 . . [5.1.2600.3610] . . c:\windows\SoftwareDistribution\Download\8fa1ad7968e63408057364ad07aa482c\SP2QFE\ntoskrnl.exe
[-] 2009-02-07 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\ntoskrnl.exe
[-] 2009-02-06 . FACEBB0CA3154F77009CDFEE78A00BBB . 2180480 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\ntoskrnl.exe
[-] 2009-02-06 . 7A95B10A73737EBF24139AAA63F5212B . 2189056 . . [5.1.2600.5755] . . c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\ntoskrnl.exe
[-] 2009-02-06 . 6A936E9D7BADAF3CAAEED1E1966EC1B0 . 2186112 . . [5.1.2600.3520] . . c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\ntoskrnl.exe
[-] 2008-04-13 . 0C89243C7C3EE199B96FCC16990E0679 . 2188928 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\ntoskrnl.exe
[-] 2006-01-13 . C3B84871DECE94E335B96FAFD756316C . 2187904 . . [5.1.2600.2765] . . c:\windows\system32\ntoskrnl.exe

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\explorer.exe
[-] 2006-01-13 . 2DEACA71A7FD77205F59D48D76B2F565 . 1075200 . . [6.00.2900.2649] . . c:\windows\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{16341361-9a18-1e87-1078-b8797fa4aa16}]
2010-02-18 08:44 1286144 ----a-w- c:\windows\system32\-M2T_P_8.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-11 7311360]
"nwiz"="nwiz.exe" [2005-11-11 1519616]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-11-11 86016]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 57344]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnsc"="c:\windows\system32\msnsc.exe" [2006-01-13 62054]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2006-01-13 44544]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [26.02.2010 16:29 108289]
S3 EP320XR;SURECOM EP-320X-R 100/10M PCI Adapter NT Driver;c:\windows\system32\drivers\EP320XR.sys [25.02.2010 20:25 25434]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www3.iamwired.net/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: {80838ACB-BC30-4D47-AFBD-4EC44B6E999D} = 213.154.124.1 193.231.252.1
FF - ProfilePath - c:\documents and settings\Pufix\Application Data\Mozilla\Firefox\Profiles\42s1xl18.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - component: c:\program files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff2.dll
FF - component: c:\program files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff3.6.dll
FF - component: c:\program files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff3.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{20bdcdcd-6a15-277e-4d2e-3851772714f7}\components\S-OfEEhbjq1.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-27 09:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-02-27 09:55:30
ComboFix-quarantined-files.txt 2010-02-27 07:55

Pre-Run: 11.438.690.304 bytes free
Post-Run: 11.995.836.416 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8195015E36AE0FE6A48FAF08B492F04E

Is there a virus or a malicious content in this log file?

please help me
thx!
May I draw your attention to THIS topic, which you should have read, and which tells you what we need you to post so that we can help you.

This thread will now be closed.

If you still need help, please start a new thread with:-
  • A HijackThis log.
  • An Uninstall list.
  • Details of the problems you're experiencing.


If for any reason you can't run HijackThis, please let us know in your post.