some virus problems with hijack log

Question

kazanova64 0 Newbie Poster

15 Years Ago

Hello everyone

I have just taken a commputer from a friend with some problems given below. I don't know how getting away these. I have hijack report in safe mode under the message. Please give me some hands.

1)Harddisks cannot open with clicking in the computer folder. It asks that to choose a program to open the disk.

2)Hidden files cannot be seen. I choose the option that "show the hidden and system files" in the folder options but it is not working.

3)In the computer, avira antivir and spybot programs are using. Avira antivir is found a0003114.exe in every half hour as a risk. Deleting it is not working.

4)I also have to clean a flashdisk and an external harddisk. Need directions

This is hijack this report of the computer.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:05:57, on 15.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O1 - Hosts: 208.117.236.70 www.youtube.com
O1 - Hosts: 208.117.236.71 www.youtube.com
O1 - Hosts: 208.117.236.72 www.youtube.com
O1 - Hosts: 83.149.99.113 foreverdivx.net
O1 - Hosts: 83.149.99.113 www.foreverdivx.net
O1 - Hosts: 69.5.88.72 megaupload.com
O1 - Hosts: 69.5.88.72 www.megaupload.com
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [NB Probe] C:\Program Files\ASUS\NB Probe\NBProbe.exe
O4 - HKLM\..\Run: [Wireless Console] C:\Program Files\ASUS\Wireless Console\wcourier.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Zshutdown] c:\sysprep\patch\sysprep.cmd
O4 - HKLM\..\Run: [GameFace Messenger] C:\Program Files\GameFace Messenger\GameFace.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Renesas AutoUpdate.lnk = C:\Program Files\Renesas\Hew\AutoUpdate\AutoUpdate.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1236337975953
O17 - HKLM\System\CCS\Services\Tcpip\..\{6EA5B1D4-53DA-485B-814D-A672289882E4}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{82908E2B-C9B6-45C3-905A-8D291978E433}: NameServer = 10.0.0.2
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 7435 bytes

windows-virus

3 Contributors
14 Replies
198 Views
3 Days Discussion Span
Latest Post 15 Years Ago Latest Post by crunchie

caperjack 875 I hate 20 Questions

15 Years Ago

hi,you posted in the wrong section for best help!just below where you click to come into windows nt//2000/ xp /2003, you will see spyware and other nasties section go there ! good luck .
http://www.daniweb.com/forums/forum64.html
j

crunchie 990 Most Valuable Poster

15 Years Ago

See screenshot below. Tells you in plain English not to post hijackthis logs here.

Logs need to be done in normal mode please.

crunchie 990 Most Valuable Poster

15 Years Ago

Thread moved to correct forum.

crunchie 990 Most Valuable Poster

15 Years Ago

Download
SDFix
and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the
following :

Restart your computer
After hearing your computer beep once during startup, but before the
Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

In Safe Mode, right click the SDFix.zip folder and choose Extract
All,
Open the extracted folder and double click RunThis.bat to
start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the
registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool
will be running and removing files.
When the desktop loads the Fixtool will complete the removal and
display Finished, then press any key to end the script and load
your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the
contents of the results file Report.txt back onto the forum with
a new HijackThis log.
Please post the SDFix log within CODE Tags.

==

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Download the update from here if you have problems.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Make sure that you restart the computer.

Post new HJT log.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

kazanova64 0 Newbie Poster · Answer 1 · 2009-03-21T04:45:15+00:00

kazanova64 0 Newbie Poster

15 Years Ago

My wrong, thanks for warning.

kazanova64 0 Newbie Poster · Answer 2 · 2009-03-21T04:51:33+00:00

and here, normal mode hijack log. Thanks for your help again.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:50:20, on 21.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O1 - Hosts: 208.117.236.70 www.youtube.com
O1 - Hosts: 208.117.236.71 www.youtube.com
O1 - Hosts: 208.117.236.72 www.youtube.com
O1 - Hosts: 83.149.99.113 foreverdivx.net
O1 - Hosts: 83.149.99.113 www.foreverdivx.net
O1 - Hosts: 69.5.88.72 megaupload.com
O1 - Hosts: 69.5.88.72 www.megaupload.com
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236337975953
O17 - HKLM\System\CCS\Services\Tcpip\..\{6EA5B1D4-53DA-485B-814D-A672289882E4}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{82908E2B-C9B6-45C3-905A-8D291978E433}: NameServer = 10.0.0.2
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 8623 bytes

kazanova64 0 Newbie Poster · Answer 3 · 2009-03-21T15:39:06+00:00

SDFix log, Malwarebytes' Anti-Malware 's log and after restart, hjt log is here.

SDFix: Version 1.240 
Run by Omer on 21.03.2009 at 10:01


Microsoft Windows XP [Srm 5.1.2600]
Running From: C:\Yeni Klas”r\SDFix


Checking Services :



Restoring Default Security Values
Restoring Default Hosts File


Rebooting


Checking Files :


Trojan Files Found:


C:\autorun.inf - Deleted


Removing Temp Files


ADS Check :


Final Check :


catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-21 10:38:24
Windows 5.1.2600 Service Pack 3 FAT NTAPI


scanning hidden processes ...


scanning hidden services ...


scanning hidden autostart entries ...


scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\ASUS\\ASUS Live Update\\LiveUpdt.exe"="C:\\Program Files\\ASUS\\ASUS Live Update\\LiveUpdt.exe:*:Enabled:LiveUpdt"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"


Remaining Files :



File Backups: - C:\YENIKL~1\SDFix\backups\backups.zip


Files with Hidden Attributes :


Mon  9 Mar 2009       108,664 ..SHR --- "C:\i.com"
Fri 13 Mar 2009        94,720 ..SHR --- "C:\WINDOWS\system32\nmdfgds0.dll"
Thu 12 Mar 2009        94,720 ..SHR --- "C:\WINDOWS\system32\nmdfgds1.dll"
Sun  9 Mar 2008           236 A..H. --- "C:\Program Files\Common Files\dx.reg"
Mon 26 Jan 2009     1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 26 Jan 2009     5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Thu  5 Mar 2009     2,260,480 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Sat  7 Mar 2009             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 14 May 2006         4,348 A..H. --- "C:\Documents and Settings\Omer\Belgelerim\Mzi§im\Lisans Yede§i\drmv1key.bak"
Thu 10 Aug 2006           401 A..H. --- "C:\Documents and Settings\Omer\Belgelerim\Mzi§im\Lisans Yede§i\drmv1lic.bak"
Sun 14 May 2006           312 A.SH. --- "C:\Documents and Settings\Omer\Belgelerim\Mzi§im\Lisans Yede§i\drmv2key.bak"


Finished!



------------------------------------------------------------------------------------
------------------------------------------------------------------------------------


Malwarebytes' Anti-Malware 1.34
Veritabanı versiyonu: 1880
Windows 5.1.2600 Service Pack 3


21.03.2009 11:28:17
mbam-log-2009-03-21 (11-28-17).txt


Tarama şekli: Derin Tarama (C:\|D:\|I:\|)
Taranmış nesneler: 278614
Geçen zaman: 25 minute(s), 45 second(s)


Etkilenmiş Hafıza İşlemleri: 0
Etkilenmiş Hafıza Modülleri: 0
Etkilenmiş Kayıt Anahtarları: 0
Etkilenmiş Kayıt Değerleri: 0
Etkilenmiş Kayıt Veri Dosyaları: 1
Etkilenmiş Klasörler: 0
Etkilenmiş Dosyalar: 2


Etkilenmiş Hafıza İşlemleri:
(Tehlikeli nesne bulunmadı)


Etkilenmiş Hafıza Modülleri:
(Tehlikeli nesne bulunmadı)


Etkilenmiş Kayıt Anahtarları:
(Tehlikeli nesne bulunmadı)


Etkilenmiş Kayıt Değerleri:
(Tehlikeli nesne bulunmadı)


Etkilenmiş Kayıt Veri Dosyaları:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.


Etkilenmiş Klasörler:
(Tehlikeli nesne bulunmadı)


Etkilenmiş Dosyalar:
C:\WINDOWS\system32\nmdfgds0.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nmdfgds1.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.


------------------------------------------------------------------------------------
------------------------------------------------------------------------------------


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:15, on 21.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\FlashGet\flashget.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236337975953
O17 - HKLM\System\CCS\Services\Tcpip\..\{6EA5B1D4-53DA-485B-814D-A672289882E4}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{82908E2B-C9B6-45C3-905A-8D291978E433}: NameServer = 10.0.0.2
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe


--
End of file - 8086 bytes

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2009-03-21T15:45:48+00:00

Go to Start > Control Panel double-click on the Software icon > add/remove programs.
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
Select it and click Remove.
Then Download and install the newest version from here:
http://www.java.com/en/download/manual.jsp

==

How is the pc now?

kazanova64 0 Newbie Poster · Answer 5 · 2009-03-21T16:56:19+00:00

thanks for your help again. lots of problems are solved. I can see my hidden files now. i can look into the c disk but i still cannot look into the d harddisk. Additionally, i don't know about how can i clean the flashdisk and the external disk. Do you have some suggestions??

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2009-03-21T17:00:24+00:00

Try this:

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

==

You should be able to plug the drives in and format them ok.

kazanova64 0 Newbie Poster · Answer 7 · 2009-03-23T03:08:45+00:00

Combofix log and new HJT log is here. Thanks for all directions. And about harddisk, it is 640gb harddisk and only half of it is empty. I have no other disk that backup the data. Isn't there a solution for that? It has the virus that runs the A0003058.exe. Antivir says that it is TR/Drop.Agent.ahdz trojan that i have completely no knowledge.

By the way, my harddisks are seen now and no hidden file problems. Thanks a lot again.

ComboFix 09-03-19.02 - Omer 2009-03-22 22:32:38.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1254.1.1055.18.1023.613 [GMT 2:00]
Running from: c:\downloads\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2.bat
C:\jeorels.cmd
c:\windows\system32\advapi32new.dll
c:\windows\system32\apphelpnew.dll
c:\windows\system32\crypt32new.dll
c:\windows\system32\d3d10core.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\kernel32new.dll
c:\windows\system32\lsprst7.dll
c:\windows\system32\msvcrtnew.dll
c:\windows\system32\ntdsapinew.dll
c:\windows\system32\powrprofnew.dll
c:\windows\system32\secur32new.dll
c:\windows\system32\ssprs.dll
c:\windows\system32\user32new.dll
c:\windows\system32\winstanew.dll
D:\2.bat
D:\Autorun.inf
D:\jeorels.cmd

.
((((((((((((((((((((((((( Files Created from 2009-02-22 to 2009-03-22 )))))))))))))))))))))))))))))))
.

2009-03-21 15:25 . 2009-03-21 15:25 <DIR> d-------- c:\documents and settings\Omer\Application Data\BitTorrent Pro
2009-03-21 15:24 . 2009-03-21 15:24 <DIR> d-------- c:\program files\BitTorrent PRO
2009-03-21 12:46 . 2009-03-21 12:45 410,984 --a------ c:\windows\system32\deploytk.dll
2009-03-21 12:46 . 2009-03-21 12:45 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-21 12:45 . 2009-03-21 12:45 <DIR> d-------- c:\program files\Java
2009-03-21 11:00 . 2009-03-21 11:00 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-21 11:00 . 2009-03-21 11:00 <DIR> d-------- c:\documents and settings\Omer\Application Data\Malwarebytes
2009-03-21 11:00 . 2009-03-21 11:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-21 11:00 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-21 11:00 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-21 10:00 . 2009-03-21 10:00 579,072 --a------ c:\windows\system32\dllcache\user32.dll
2009-03-21 09:56 . 2009-03-21 09:56 <DIR> d-------- c:\windows\ERUNT
2009-03-20 00:58 . 2009-03-20 00:58 <DIR> d-------- c:\documents and settings\Omer\Application Data\nView_Wallpaper
2009-03-18 20:02 . 2009-03-18 20:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-03-17 18:42 . 2009-03-17 18:43 <DIR> d-------- c:\program files\Glary Utilities
2009-03-17 18:41 . 2009-03-17 18:41 <DIR> d-------- c:\program files\Wise Registry Cleaner 3
2009-03-17 18:41 . 2009-03-17 18:41 <DIR> d-------- c:\program files\IObit
2009-03-17 18:41 . 2009-03-17 18:41 <DIR> d-------- c:\documents and settings\Omer\Application Data\IObit
2009-03-17 18:39 . 2009-03-17 18:39 <DIR> d-------- c:\program files\CCleaner
2009-03-17 03:57 . 2009-03-17 03:57 172 --a------ c:\windows\ODBC.INI
2009-03-17 03:56 . 2009-03-17 03:56 <DIR> d-------- c:\windows\system32\js
2009-03-17 03:56 . 2009-03-17 03:56 <DIR> d-------- c:\windows\system32\images
2009-03-17 03:56 . 2009-03-17 03:56 <DIR> d-------- c:\windows\system32\html
2009-03-17 03:56 . 2009-03-17 03:56 <DIR> d-------- c:\windows\system32\css
2009-03-17 03:56 . 2009-03-17 03:56 <DIR> d-------- c:\program files\Business Objects
2009-03-17 03:52 . 2009-03-17 03:52 <DIR> d-------- c:\program files\MSXML 6.0
2009-03-17 03:50 . 2009-03-17 03:50 <DIR> d-------- c:\program files\Microsoft SQL Server
2009-03-17 03:49 . 2009-03-17 03:49 <DIR> d-------- c:\program files\Microsoft Device Emulator
2009-03-17 03:48 . 2009-03-17 03:48 <DIR> d-------- c:\program files\Windows Mobile 5.0 SDK R2
2009-03-17 03:47 . 2009-03-17 03:47 <DIR> d-------- c:\program files\Microsoft Synchronization Services
2009-03-17 03:47 . 2009-03-17 03:47 <DIR> d-------- c:\program files\Microsoft SQL Server Compact Edition
2009-03-17 03:41 . 2009-03-17 03:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\PreEmptive Solutions
2009-03-17 03:35 . 2009-03-17 03:35 <DIR> d-------- c:\windows\symbols
2009-03-17 03:32 . 2009-03-17 03:32 <DIR> d-------- c:\program files\Microsoft.NET
2009-03-17 03:32 . 2009-03-17 03:32 <DIR> d-------- c:\program files\Microsoft Visual Studio 9.0
2009-03-17 03:32 . 2009-03-17 03:32 <DIR> d-------- c:\program files\Microsoft SDKs
2009-03-17 03:32 . 2009-03-17 03:32 <DIR> d-------- c:\program files\HTML Help Workshop
2009-03-17 03:32 . 2009-03-17 03:32 <DIR> d-------- c:\program files\Common Files\Merge Modules
2009-03-17 03:32 . 2009-03-17 03:32 <DIR> d-------- c:\program files\CE Remote Tools
2009-03-17 03:31 . 2009-03-17 03:31 <DIR> d-------- c:\program files\Microsoft Web Designer Tools
2009-03-17 03:30 . 2009-03-17 03:30 <DIR> dr-h----- C:\MSOCache
2009-03-17 03:29 . 2009-03-17 03:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-17 03:27 . 2009-03-17 03:27 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-17 03:27 . 2009-03-17 03:27 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-17 03:27 . 2009-03-17 03:27 <DIR> d-------- c:\program files\MSBuild
2009-03-17 03:26 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-15 17:04 . 2005-12-20 18:59 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS
2009-03-15 17:04 . 2005-12-20 19:11 <DIR> dr------- c:\documents and settings\Administrator\Sık Kullanılanlar
2009-03-15 17:04 . 2005-12-20 19:11 <DIR> dr------- c:\documents and settings\Administrator\Belgelerim
2009-03-15 17:04 . 2005-12-20 19:07 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
2009-03-15 17:04 . 2005-12-20 19:16 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
2009-03-15 17:04 . 2009-03-15 17:04 <DIR> d-------- c:\documents and settings\Administrator
2009-03-15 16:42 . 2009-03-15 16:42 <DIR> d-------- c:\program files\Trend Micro
2009-03-13 17:14 . 2009-03-13 17:14 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-13 17:14 . 2009-03-13 17:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-13 16:58 . 2009-03-13 16:58 <DIR> d-------- c:\program files\Avira
2009-03-13 16:58 . 2009-03-13 16:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-03-13 16:25 . 1996-10-15 18:01 298,496 --a------ c:\windows\uninst.exe
2009-03-13 16:25 . 1994-09-21 04:00 12,800 --a------ c:\windows\system32\WING32.DLL
2009-03-13 16:22 . 2004-08-04 15:00 180,770 --a------ c:\windows\system32\dllcache\c_20932.nls
2009-03-11 15:35 . 2008-04-14 18:00 221,184 --a------ c:\windows\system32\wmpns.dll
2009-03-10 14:41 . 2009-03-10 14:41 <DIR> d-------- c:\program files\Common Files\3DO Shared
2009-03-10 14:40 . 2009-03-10 14:40 <DIR> d-------- c:\program files\directx
2009-03-08 11:18 . 2009-03-08 11:18 146 --a------ c:\windows\capture.INI
2009-03-08 11:14 . 2009-03-08 11:14 <DIR> d-------- c:\program files\Orcad
2009-03-08 10:54 . 2009-03-09 11:04 108,664 -r-hs---- C:\i.com
2009-03-07 23:47 . 2009-03-07 23:47 1,025 --a------ c:\windows\system32\sysprs7.tgz
2009-03-07 23:47 . 2009-03-07 23:47 1,025 --a------ c:\windows\system32\sysprs7.dll
2009-03-07 23:47 . 2009-03-07 23:47 1,025 --a------ c:\windows\system32\clauth2.dll
2009-03-07 23:47 . 2009-03-07 23:47 1,025 --a------ c:\windows\system32\clauth1.dll
2009-03-07 23:47 . 2009-03-18 21:05 354 --a------ c:\windows\system32\lsprst7.tgz
2009-03-07 23:47 . 2009-03-18 21:05 87 --a------ c:\windows\system32\ssprs.tgz
2009-03-07 17:51 . 2009-03-07 17:51 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-03-07 17:50 . 2009-03-07 17:50 <DIR> d--h----- c:\windows\PIF
2009-03-07 17:45 . 2009-03-07 17:45 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-07 17:45 . 2009-03-07 17:45 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-03-06 19:30 . 2008-03-09 07:25 236 --ah----- c:\program files\Common Files\dx.reg
2009-03-06 19:10 . 2009-03-06 19:10 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-03-06 19:07 . 2009-03-06 19:07 <DIR> d-------- c:\program files\3DO
2009-03-06 18:42 . 2009-03-06 18:42 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-03-06 18:41 . 2009-03-06 18:41 <DIR> d-------- c:\program files\Common Files\Adobe
2009-03-06 18:35 . 2009-03-06 18:35 <DIR> d-------- c:\program files\NOS
2009-03-06 18:35 . 2009-03-06 18:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2009-03-06 15:57 . 2009-03-06 15:57 <DIR> d-------- c:\documents and settings\Omer\Application Data\MathWorks
2009-03-06 15:50 . 2009-03-06 15:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\GRETECH
2009-03-06 15:50 . 2002-02-14 10:26 647,872 --a------ c:\windows\system32\mscomct2.ocx
2009-03-06 15:50 . 2004-03-01 22:05 407,104 --a------ c:\windows\system32\MSHFLXGD.OCX
2009-03-06 15:50 . 2004-02-11 14:37 203,976 --a------ c:\windows\system32\RICHTX32.OCX
2009-03-06 15:50 . 2002-02-13 10:20 2,362 --a------ c:\windows\system32\mscomct2.dep
2009-03-06 15:49 . 2009-03-06 15:49 <DIR> d-------- c:\documents and settings\Omer\Application Data\GRETECH
2009-03-06 15:49 . 2009-03-06 15:49 645,120 --a------ c:\windows\system32\config.gms
2009-03-06 15:41 . 2009-03-06 15:41 <DIR> d-------- c:\documents and settings\Omer\Tracing
2009-03-06 15:39 . 2009-03-06 15:39 <DIR> d-------- c:\program files\Microsoft
2009-03-06 15:38 . 2009-03-06 15:38 <DIR> d-------- c:\program files\Windows Live SkyDrive
2009-03-06 15:38 . 2009-03-06 15:38 <DIR> d-------- C:\Downloads
2009-03-06 15:37 . 2009-03-06 15:37 <DIR> d-------- c:\program files\Windows Live
2009-03-06 15:26 . 2009-03-06 15:26 <DIR> d-------- c:\program files\MATLAB
2009-03-06 15:25 . 2009-03-06 15:25 <DIR> d-------- c:\program files\Common Files\Windows Live
2009-03-06 15:25 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-03-06 15:25 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
2009-03-06 15:25 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-03-06 15:18 . 2009-03-06 15:18 <DIR> d-------- c:\program files\MSXML 4.0
2009-03-06 15:15 . 2008-12-21 00:46 6,066,688 --------- c:\windows\system32\dllcache\ieframe.dll
2009-03-06 15:15 . 2007-04-17 11:32 2,455,488 --------- c:\windows\system32\dllcache\ieapfltr.dat
2009-03-06 15:15 . 2007-03-08 07:12 1,015,808 --------- c:\windows\system32\dllcache\ieframe.dll.mui
2009-03-06 15:15 . 2008-12-21 00:46 459,264 --------- c:\windows\system32\dllcache\msfeeds.dll
2009-03-06 15:15 . 2008-12-21 00:46 383,488 --------- c:\windows\system32\dllcache\ieapfltr.dll
2009-03-06 15:15 . 2008-12-21 00:46 267,776 --------- c:\windows\system32\dllcache\iertutil.dll
2009-03-06 15:15 . 2008-12-21 00:46 63,488 --------- c:\windows\system32\dllcache\icardie.dll
2009-03-06 15:15 . 2008-12-21 00:46 52,224 --------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-03-06 15:15 . 2008-12-19 11:10 13,824 --------- c:\windows\system32\dllcache\ieudinit.exe
2009-03-06 14:38 . 2008-10-15 18:36 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2009-03-06 14:21 . 2009-03-06 14:21 <DIR> d-------- c:\windows\system32\tr-tr
2009-03-06 14:21 . 2009-03-06 14:21 <DIR> d-------- c:\windows\system32\tr
2009-03-06 14:21 . 2009-03-06 14:21 <DIR> d-------- c:\windows\system32\bits
2009-03-06 14:21 . 2009-03-06 14:21 <DIR> d-------- c:\windows\l2schemas
2009-03-06 14:19 . 2009-03-06 14:19 <DIR> d-------- c:\windows\ServicePackFiles
2009-03-06 14:14 . 2009-03-06 14:14 <DIR> d-------- c:\windows\EHome
2009-03-06 13:47 . 2008-09-04 19:16 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2009-03-06 13:35 . 2004-08-03 22:41 1,309,184 --------- c:\windows\system32\drivers\mtlstrm.sys
2009-03-06 13:09 . 2008-06-14 19:33 272,000 --------- c:\windows\system32\dllcache\bthport.sys
2009-03-06 13:05 . 2009-03-06 13:05 <DIR> d-------- c:\program files\UsbTestBench
2009-03-06 13:05 . 2004-03-08 23:00 224,016 --a------ c:\windows\system32\tabctl32.ocx
2009-03-06 13:04 . 2009-03-06 13:04 <DIR> d-------- C:\Workspace
2009-03-06 13:04 . 2000-10-20 13:25 446,464 --a------ c:\windows\system32\hhactivex.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-09 14:05 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 16:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-01-16 19:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2005-07-28 102400]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-07-01 7118848]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2005-06-16 86016]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-12-22 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-12-22 688218]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-05-31 401408]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-06-03 385024]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2005-05-31 356352]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Flashget"="c:\program files\FlashGet\flashget.exe" [2007-09-25 2007088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-21 148888]
"nwiz"="nwiz.exe" [2005-07-01 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-06 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2005-05-31 22:46 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programlar^Başlangıç^Renesas AutoUpdate.lnk]
path=c:\documents and settings\All Users\Start Menu\Programlar\Başlangıç\Renesas AutoUpdate.lnk
backup=c:\windows\pss\Renesas AutoUpdate.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Omer^Start Menu^Programlar^Başlangıç^H3 The Shadow of Death(TM).lnk]
path=c:\documents and settings\Omer\Start Menu\Programlar\Başlangıç\H3 The Shadow of Death(TM).lnk
backup=c:\windows\pss\H3 The Shadow of Death(TM).lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Live Update]
--a------ 2003-09-19 12:54 172032 c:\program files\ASUS\ASUS Live Update\ALU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-12-29 12:40 687560 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
--a------ 2007-09-25 10:10 2007088 c:\program files\FlashGet\flashget.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2009-02-06 18:53 3885408 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NB Probe]
--a------ 2005-07-27 17:07 765952 c:\program files\ASUS\NB Probe\NBProbe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wireless Console]
--a------ 2005-07-22 14:36 57344 c:\program files\ASUS\Wireless Console\wcourier.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\ASUS\\ASUS Live Update\\LiveUpdt.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16999:TCP"= 16999:TCP:tcp1

R0 R592;R592;c:\windows\system32\drivers\R592.sys [2004-10-15 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [2004-10-15 27264]
S3 E1USB;Renesas E-Series USB Driver;c:\windows\system32\drivers\E1usb.sys [2009-03-06 44672]

--- Other Services/Drivers In Memory ---

*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - EvtEng
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - helpsvc
*Deregistered* - ImapiService
*Deregistered* - Irmon
*Deregistered* - JavaQuickStarterService
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MSSQL$SQLEXPRESS
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - NVSvc
*Deregistered* - OwnershipProtocol
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasMan
*Deregistered* - RegSrvc
*Deregistered* - RpcSs
*Deregistered* - S24EventMonitor
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - spmgr
*Deregistered* - Spooler
*Deregistered* - SQLBrowser
*Deregistered* - SQLWriter
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WmiApSrv
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - xdw.com
\Shell\open\Command - xdw.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1832bc2d-0b60-11de-a6fb-001500474dda}]
\Shell\AutoRun\command - H:\2.bat
\Shell\open\Command - H:\2.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d5e0d4c1-09ac-11de-a6ef-806d6172696f}]
\Shell\AutoRun\command - xdw.com
\Shell\open\Command - xdw.com
.
Contents of the 'Scheduled Tasks' folder

2009-03-22 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-02-12 17:10]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-GameFace Messenger - c:\program files\GameFace Messenger\GameFace.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.tr/
uInternet Connection Wizard,ShellNext = iexplore
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
TCP: {6EA5B1D4-53DA-485B-814D-A672289882E4} = 208.67.222.222,208.67.220.220
TCP: {82908E2B-C9B6-45C3-905A-8D291978E433} = 10.0.0.2
FF - ProfilePath - c:\documents and settings\Omer\Application Data\Mozilla\Firefox\Profiles\nmqvemd4.default\
FF - prefs.js: browser.startup.homepage - www.google.com.tr
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-22 22:41:11
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1120)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Completion time: 2009-03-22 22:47:12
ComboFix-quarantined-files.txt 2009-03-22 20:47:04

Pre-Run: 1.665.826.816 bayt boş
Post-Run: 1,739,194,368 bayt boş

324 --- E O F --- 2009-03-22 01:03:06

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:08:05, on 22.03.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236337975953
O17 - HKLM\System\CCS\Services\Tcpip\..\{6EA5B1D4-53DA-485B-814D-A672289882E4}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{82908E2B-C9B6-45C3-905A-8D291978E433}: NameServer = 10.0.0.2
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 7875 bytes

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 8 · 2009-03-23T14:48:10+00:00

And about harddisk, it is 640gb harddisk and only half of it is empty. I have no other disk that backup the data. Isn't there a solution for that?

I am not sure what you are asking me?
As long as you do not boot from that drive, or activate any files on it, you can hook it up and format it, or run a virus scan or whatever.

==

Log is clean.

kazanova64 0 Newbie Poster · Answer 9 · 2009-03-23T15:28:34+00:00

i just ask that if there is a program like combofix that clean the harddisk because i cannot format it nowadays. But it is not the main problem and you solved all problems that i asked. Thanks again.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 10 · 2009-03-23T16:15:51+00:00

Is it just a storage/backup HD? Plug it in and run MBA-M.

Let's get rid of Combofix now that we are finished with it.

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the /, it needs to be there.