below is the logs of HJT n kasperscan
Logfile of HijackThis v1.99.1
Scan saved at 10:09:37 PM, on 4/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ABIT\ABIT Manager\ABITManager.exe
D:\Program Files\ABIT\ABIT Manager\abiteq.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\QuickTime\qttask.exe
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Spyware Doctor\sdhelp.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\WgaTray.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\mspaint.exe
D:\WINDOWS\System32\svchost.exe
D:\Documents and Settings\Administrator\My Documents\HJT\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = "http://runonce.msn.com/?v
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.singnet.com.sg:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - D:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: HelpIE Class - {589A6FED-A214-4FE3-8D1E-CD07BC634D89} - D:\WINDOWS\system32\HelpIE.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ABITManager] D:\Program Files\ABIT\ABIT Manager\ABITManager.exe
O4 - HKLM\..\Run: [ABITEQ] D:\Program Files\ABIT\ABIT Manager\abiteq.exe -M
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [xzhfhtcwixk] D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by119fd.bay119.hotmail.msn.com/r ... nPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{678B4F31-AB23-40EA-A3DD-B9FCDB9EA25A}: NameServer = 202.156.1.48,202.156.1.68
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, April 09, 2007 10:08:51 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 9/04/2007
Kaspersky Anti-Virus database records: 292847
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
Scan Statistics:
Total number of scanned objects: 29671
Number of viruses found: 11
Number of infected objects: 38 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:42:47
Infected Object Name / Virus Name / Last Action
C:\DL\mirc616.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\DL\mirc616.exe mIRC: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\!KillBox\Kernel32.exe Infected: Trojan-PSW.Win32.WOW.qm skipped
D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\cert8.db Object is locked skipped
D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\formhistory.dat Object is locked skipped
D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\history.dat Object is locked skipped
D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\key3.db Object is locked skipped
D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\parent.lock Object is locked skipped
D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\search.sqlite Object is locked skipped
D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\urlclassifier2.sqlite Object is locked skipped
D:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\Cache\_CACHE_001_ Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\Cache\_CACHE_002_ Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\Cache\_CACHE_003_ Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\lxr6x2n8.default\Cache\_CACHE_MAP_ Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007040920070410\index.dat Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\1271625.exe Infected: Trojan-Dropper.Win32.Small.awk skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\4.exe Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\5.exe Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\Rav31.dll Object is locked skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\Tmp3.tmp.rom Infected: Trojan-PSW.Win32.WOW.qm skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\Tmp4.tmp.rom Infected: Trojan-PSW.Win32.WOW.qm skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\~Tm2.tmp.rom Infected: Trojan-PSW.Win32.WOW.qm skipped
D:\Documents and Settings\Administrator\Local Settings\Temp\~Tm3.tmp.rom Infected: Trojan-PSW.Win32.WOW.qm skipped
D:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
D:\Documents and Settings\Administrator\My Documents\HJT\backups\backup-20070409-205825-766.dll Infected: not-a-virus:AdWare.Win32.BHO.cf skipped
D:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
D:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
D:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
D:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
D:\Documents and Settings\All Users\Templates\temp.exe Object is locked skipped
D:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
D:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
D:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
D:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
D:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
D:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-04-09.21-05-29.log Object is locked skipped
D:\Program Files\Internet Explorer\InfoMs.tdm Infected: Trojan-PSW.Win32.Delf.kt skipped
D:\Program Files\Internet Explorer\InfoMs.tp3 Infected: Trojan-PSW.Win32.Delf.kt skipped
D:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\WINDOWS\bar.exe/data0002 Infected: Trojan-Clicker.Win32.Agent.io skipped
D:\WINDOWS\bar.exe NSIS: infected - 1 skipped
D:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
D:\WINDOWS\SchedLgU.Txt Object is locked skipped
D:\WINDOWS\SoftwareDistribution\EventCache\{8113AD64-0CE8-4ABD-B20C-E5B39C9D6042}.bin Object is locked skipped
D:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
D:\WINDOWS\Sti_Trace.log Object is locked skipped
D:\WINDOWS\system32\1010s.exe/stream/data0002/stream/data0001 Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\system32\1010s.exe/stream/data0002/stream/data0003 Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\system32\1010s.exe/stream/data0002/stream Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\system32\1010s.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\system32\1010s.exe/stream Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\system32\1010s.exe NSIS: infected - 5 skipped
D:\WINDOWS\system32\ad_1485.exe/data0002 Infected: not-a-virus:AdWare.Win32.Boran.ae skipped
D:\WINDOWS\system32\ad_1485.exe NSIS: infected - 1 skipped
D:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
D:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
D:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
D:\WINDOWS\system32\config\default Object is locked skipped
D:\WINDOWS\system32\config\default.LOG Object is locked skipped
D:\WINDOWS\system32\config\Internet.evt Object is locked skipped
D:\WINDOWS\system32\config\SAM Object is locked skipped
D:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
D:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
D:\WINDOWS\system32\config\SECURITY Object is locked skipped
D:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
D:\WINDOWS\system32\config\software Object is locked skipped
D:\WINDOWS\system32\config\software.LOG Object is locked skipped
D:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
D:\WINDOWS\system32\config\system Object is locked skipped
D:\WINDOWS\system32\config\system.LOG Object is locked skipped
D:\WINDOWS\system32\dodolook133.exe/data0003/data0003 Infected: not-a-virus:AdWare.Win32.Cinmus.o skipped
D:\WINDOWS\system32\dodolook133.exe/data0003/data0004 Infected: not-a-virus:AdWare.Win32.Cinmus.o skipped
D:\WINDOWS\system32\dodolook133.exe/data0003 Infected: not-a-virus:AdWare.Win32.Cinmus.o skipped
D:\WINDOWS\system32\dodolook133.exe NSIS: infected - 3 skipped
D:\WINDOWS\system32\drivers\ndcia.sys Object is locked skipped
D:\WINDOWS\system32\drivers\romman.sys Object is locked skipped
D:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
D:\WINDOWS\system32\drivers\sptd8365.sys Object is locked skipped
D:\WINDOWS\system32\drivers\stdio.sys Object is locked skipped
D:\WINDOWS\system32\drivers\tnswgk39.sys Object is locked skipped
D:\WINDOWS\system32\drivers\usb8028.sys Infected: not-a-virus:AdWare.Win32.WSearch.n skipped
D:\WINDOWS\system32\drivers\vaxscsi.sys Object is locked skipped
D:\WINDOWS\system32\gb01.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.BHO.av skipped
D:\WINDOWS\system32\gb01.exe/stream Infected: not-a-virus:AdWare.Win32.BHO.av skipped
D:\WINDOWS\system32\gb01.exe NSIS: infected - 2 skipped
D:\WINDOWS\system32\h323log.txt Object is locked skipped
D:\WINDOWS\system32\HelpIE.dll Infected: not-a-virus:AdWare.Win32.BHO.cf skipped
D:\WINDOWS\system32\MDserivces\services\reg.exe Object is locked skipped
D:\WINDOWS\system32\mshtmlsed.exe Infected: not-a-virus:AdWare.Win32.BHO.cf skipped
D:\WINDOWS\system32\trtbc.dll Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
D:\WINDOWS\system32\wbem\ydpuq.dll Object is locked skipped
D:\WINDOWS\Temp\base.exe/stream/data0001 Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\Temp\base.exe/stream/data0003 Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\Temp\base.exe/stream Infected: Trojan-Downloader.Win32.Agent.bcd skipped
D:\WINDOWS\Temp\base.exe NSIS: infected - 3 skipped
D:\WINDOWS\Temp\base.exe UPX: infected - 3 skipped
D:\WINDOWS\Temp\base.exe PE_Patch.UPX: infected - 3 skipped
D:\WINDOWS\wiadebug.log Object is locked skipped
D:\WINDOWS\wiaservc.log Object is locked skipped
D:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.