Hello, and thank you to whomever is reading this with the intention to help me. My little brother downloaded a file (virus) and it messed our comp up pretty good. There's no C:, no control panel, a lot of options are limited. It took over our background but I fixed that. Every time we start our comp up it puts 3 new items on our desktop, error clean up, privacy protector and one other false program. The bottom right of the screen where the clock is, it says "VIRUS ALERT!" and the clock has been changed to a 24 hour clock instead now. Constant messages keep popping up saying need virus protection programs, and of course they have a link to a shady site which is obviously just more spy ware. My Task Manager has also been "Disabled by administrator". I also cant system restore, it says no changes have been made, I decided to disable system restore. Heres my Log from DSS, any help would be greatly appreciated!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:25: VIRUS ALERT!, on 8/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\admin\Desktop\windows-kb890830-v2.0.exe
c:\6c87c757dcb8b0f047a5460f90\mrtstub.exe
C:\WINDOWS\system32\MRT.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\admin\Desktop\dss.exe
C:\DOCUME~1\admin\Desktop\admin.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1561552
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPLive.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O20 - AppInit_DLLs: C:\program,files\relevantknowledge\rlai.dll,C:\program,files\relevantknowledge\rlai.dll,C:\program,files\relevantknowledge\rlai.dll,C:\program files\relevantknowledge\rlai.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: eqvwamkl - {2FF2914C-3346-4045-9F98-36DCE2B4FC40} - C:\WINDOWS\eqvwamkl.dll (file missing)
O21 - SSODL: wnslvxtf - {9A1CD356-F9F8-4E52-99A6-4CE55CA7C995} - C:\WINDOWS\wnslvxtf.dll
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O24 - Desktop Component 0: Privacy Protection - (no file)
--
End of file - 8322 bytes
-- Files created between 2008-07-03 and 2008-08-03 -----------------------------
2008-08-03 22:27:01 0 d-------- C:\WINDOWS\LastGood
2008-08-03 22:20:44 0 d-------- C:\Program Files\EsetOnlineScanner
2008-08-03 22:17:34 0 d-------- C:\6c87c757dcb8b0f047a5460f90
2008-08-03 22:17:02 0 d-------- C:\Documents and Settings\admin\Application Data\Malwarebytes
2008-08-03 22:16:58 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-03 22:16:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-03 21:02:31 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-08-03 20:28:48 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-08-03 20:28:47 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-08-03 20:09:57 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-08-03 20:09:56 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-08-03 20:09:56 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-08-03 20:09:56 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-08-03 20:09:56 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-08-03 20:09:56 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-08-03 20:09:56 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-08-03 20:09:55 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-08-03 20:09:55 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-08-03 20:09:04 0 d-------- C:\Documents and Settings\admin\Application Data\PC Tools
2008-08-03 19:58:23 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-08-03 19:46:13 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-08-03 19:46:13 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-08-03 19:46:13 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-08-03 19:46:12 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-08-03 19:46:12 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-08-03 19:46:12 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-08-03 18:04:37 0 d-------- C:\Program Files\Spyware Doctor
2008-08-03 18:04:22 0 d-------- C:\Program Files\Common Files\Download Manager
2008-08-03 17:49:23 0 d-------- C:\Documents and Settings\admin\Application Data\TmpRecentIcons
2008-08-03 17:49:15 233472 --a------ C:\WINDOWS\wnslvxtf.dll
2008-07-30 01:48:51 0 d--h----- C:\WINDOWS\PIF
2008-07-24 03:17:36 2829 --a------ C:\WINDOWS\War3Unin.pif
2008-07-24 03:17:36 139264 --a------ C:\WINDOWS\War3Unin.exe <Not Verified; Blizzard Entertainment; Warcraft III Uninstaller>
2008-07-24 03:17:36 76925 --a------ C:\WINDOWS\War3Unin.dat
2008-07-24 03:16:12 0 d-------- C:\Program Files\Warcraft III
2008-07-20 02:05:00 0 d-------- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
2008-07-20 02:04:55 0 d-------- C:\Documents and Settings\admin\Application Data\DAEMON Tools Pro
2008-07-20 01:20:03 0 d-------- C:\Program Files\Square Soft, Inc
2008-07-20 01:19:39 314880 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-07-20 01:09:04 0 d-------- C:\Program Files\DAEMON Tools Toolbar
2008-07-20 01:09:02 0 d-------- C:\Program Files\DAEMON Tools Lite
2008-07-20 01:04:36 717296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-07-20 01:04:33 0 d-------- C:\Documents and Settings\admin\Application Data\DAEMON Tools
2008-07-20 00:57:21 0 d-------- C:\Documents and Settings\admin\WINDOWS
2008-07-20 00:56:24 0 d-------- C:\Program Files\Undisker
2008-07-13 19:24:30 48956922 --a------ C:\WINDOWS\MassEffect.exe <Not Verified; BioWare; Mass Effect>
2008-07-13 18:47:01 0 d-------- C:\WINDOWS\DETONATiON
2008-07-13 18:46:55 0 d-------- C:\WINDOWS\software
2008-07-13 18:46:55 0 d-------- C:\WINDOWS\Other
2008-07-13 18:46:55 0 d-------- C:\WINDOWS\DirectX
2008-07-13 18:46:40 0 d-------- C:\WINDOWS\Support
2008-07-13 18:46:40 0 d-------- C:\WINDOWS\Mass Effect
2008-07-13 18:46:38 0 d-------- C:\WINDOWS\Engine
2008-07-13 18:46:30 0 d-------- C:\WINDOWS\docs
2008-07-13 18:46:28 0 d-------- C:\WINDOWS\data
2008-07-13 18:37:42 0 d-------- C:\WINDOWS\BioGame
2008-07-13 18:37:41 0 d-------- C:\WINDOWS\Binaries
2008-07-13 18:30:11 160768 --a------ C:\WINDOWS\unrar.dll
2008-07-13 18:28:20 286208 --a------ C:\WINDOWS\binkw32.dll
2008-07-13 16:33:40 0 d-------- C:\Program Files\Common Files\BioWare
2008-07-13 16:24:30 0 d-------- C:\Program Files\Mass Effect
2008-07-11 17:20:34 0 d-------- C:\Program Files\Bioshock
2008-07-11 16:44:45 0 d-------- C:\Documents and Settings\admin\Application Data\Bioshock
2008-07-11 01:31:45 0 d-------- C:\Program Files\RelevantKnowledge
2008-07-11 01:25:23 0 d-------- C:\Documents and Settings\admin\Application Data\DivX
2008-07-10 04:02:20 0 d-------- C:\Program Files\Veoh Networks
2008-07-10 04:02:01 0 d-------- C:\WINDOWS\Downloaded Installations
2008-07-09 03:02:26 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-09 03:02:22 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-07-09 03:02:22 0 d-------- C:\Documents and Settings\admin\Application Data\SUPERAntiSpyware.com
2008-07-09 03:02:12 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-09 02:33:37 119808 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-07-09 02:33:37 208896 --a------ C:\WINDOWS\system32\ConTest.dll <Not Verified; Ascentive; ConnectionTester>
-- Find3M Report ---------------------------------------------------------------
2008-08-03 18:50:34 0 d-------- C:\Program Files\TVAntsX
2008-08-03 18:04:22 0 d-------- C:\Program Files\Common Files
2008-08-03 17:07:07 0 d-------- C:\Program Files\Electronic Arts
2008-08-01 05:46:46 0 d-------- C:\Documents and Settings\admin\Application Data\LimeWire
2008-07-21 19:05:27 0 d-------- C:\Program Files\Starcraft
2008-07-11 16:23:27 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-11 01:25:13 0 d-------- C:\Program Files\DivX
2008-07-10 01:19:41 0 d-------- C:\Program Files\BitTorrent
2008-07-08 23:59:53 0 d-------- C:\Program Files\Hotspot_Shield
2008-07-02 00:45:46 1292 --a------ C:\WINDOWS\mozver.dat
2008-07-01 03:17:49 0 d-------- C:\Program Files\GRETECH
2008-06-27 01:51:01 0 d-------- C:\Program Files\Ultratron
2008-06-27 01:37:02 0 d-------- C:\Program Files\ReflexiveArcade
2008-06-27 01:20:59 0 d-------- C:\Program Files\QuickTime
2008-06-27 01:20:31 0 d-------- C:\Program Files\Apple Software Update
2008-06-24 02:53:14 0 d-------- C:\Program Files\PPLive
2008-06-23 03:30:39 0 d-------- C:\Program Files\DAUM
2008-06-22 15:31:53 0 d-------- C:\Documents and Settings\admin\Application Data\Winamp
2008-06-22 15:21:15 0 d-------- C:\Program Files\Winamp
2008-06-22 15:20:21 0 d-------- C:\Program Files\Winamp Toolbar
2008-06-22 15:20:19 0 d-------- C:\Program Files\Winamp Remote
2008-06-22 03:04:12 0 d-------- C:\Program Files\VideoLAN
2008-06-05 03:01:59 0 d-------- C:\Documents and Settings\admin\Application Data\PPLive
2008-05-30 11:22:22 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-05-30 11:18:56 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-05-30 11:18:56 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-05-30 11:18:50 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-30 11:18:48 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-05-30 11:18:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-30 11:18:48 815104 --a------ C:\WINDOWS\system32\divx_xx0a.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-30 11:18:48 683520 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-30 11:18:00 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
07/09/2008 00:00: VIRUS ALERT! 1569304 --a------ C:\Program Files\Hotspot_Shield\tbHot1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [11/22/2007 02:40: VIRUS ALERT! C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/03/2005 04:43: VIRUS ALERT! C:\WINDOWS\Alcmtr.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [06/28/2007 10:43: VIRUS ALERT!]
"nwiz"="nwiz.exe" [06/28/2007 10:43: VIRUS ALERT! C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [06/28/2007 10:43: VIRUS ALERT!]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 06:25: VIRUS ALERT!]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05/25/2008 10:46: VIRUS ALERT!]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 22:16: VIRUS ALERT!]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50: VIRUS ALERT!]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [08/03/2008 18:36: VIRUS ALERT!]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 13:34: VIRUS ALERT!]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [02/28/2006 06:00: VIRUS ALERT!]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 10:24: VIRUS ALERT!]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" []
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [05/28/2008 10:33: VIRUS ALERT!]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [06/19/2008 15:15: VIRUS ALERT!]
"@"="" []
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [07/17/2008 06:20: VIRUS ALERT!]
-- End of Deckard's System Scanner: finished at 2008-08-03 23:26:28 ------------
Heres Malwarebytes anti-malware:
Malwarebytes' Anti-Malware 1.24
Database version: 1020
Windows 5.1.2600 Service Pack 2
11:41:51 PM 8/3/2008
mbam-log-8-3-2008 (23-41-51).txt
Scan type: Quick Scan
Objects scanned: 40695
Time elapsed: 5 minute(s), 56 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 5
Registry Values Infected: 2
Registry Data Items Infected: 15
Folders Infected: 1
Files Infected: 7
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\wnslvxtf.dll (Trojan.Zlob) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{9a1cd356-f9f8-4e52-99a6-4ce55ca7c995} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.bmgb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\wnslvxtf (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\eqvwamkl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76477-OEM-0015951-46783) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (h:mm:ss tt) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
C:\Documents and Settings\All Users\Start Menu\Programs\RelevantKnowledge (Spyware.Marketscore) -> Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\wnslvxtf.dll (Trojan.Zlob) -> Delete on reboot.
C:\Documents and Settings\All Users\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\RelevantKnowledge\Support.lnk (Spyware.Marketscore) -> Quarantined and deleted successfully.
C:\Documents and Settings\admin\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\admin\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\admin\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
