Win32:Trojan-gen {Other} - Free Antivirus Forum

Win32:Trojan-gen {Other}

BullGuard Antivirus Forum > Virus Removal > Removal Help > Win32:Trojan-gen {Other}

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

piku
New Member

Date Joined Jun 2008
Total Posts : 1

Posted 7-20-2008 10:28 (GMT +2)

Hii
This is my first post.I got infected by Win32:Trojan-gen {Other},Avast 4.8 Home Edition detected this.Previously I had Ares and utorrent installed but now I've removed those.I guess I got this problem through Ares,a P2P software.Therfore it would be great if you guys help me out.I did what Avast recommended but still this problem persists when I visit the folder where from I got this problem
I'm attaching my HJT log file and ComboFix log along with SuperAntiSpyware log
HJT Log :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:52 PM, on 7/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\sttray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: 24Online Client.lnk = C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_03) -
O16 - DPF: {CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_03) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{13623D2E-492C-4C71-9AAB-F381A4D84446}: NameServer = 172.16.0.10,202.54.1.18
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe

--
End of file - 4894 bytes

ComboFix log :

ComboFix 08-07-13.11 - Piku 2008-07-20 13:38:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.628 [GMT 5.5:30]
Running from: C:\Documents and Settings\Piku\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ciadvs.exe
C:\WINDOWS\system32\ciadvss.exe

.
((((((((((((((((((((((((( Files Created from 2008-06-20 to 2008-07-20 )))))))))))))))))))))))))))))))
.

2008-07-20 13:16 . 2008-07-20 13:16 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-07-20 13:16 . 2008-07-20 13:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-20 13:16 . 2008-07-20 13:16 <DIR> d-------- C:\Documents and Settings\Piku\Application Data\SUPERAntiSpyware.com
2008-07-20 13:16 . 2008-07-20 13:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-20 11:38 . 2008-07-20 11:38 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-18 20:26 . 2004-08-30 21:00 1,069,056 --a------ C:\WINDOWS\system32\gpedits.exe
2008-07-18 20:26 . 2008-07-18 20:26 37,888 --a------ C:\WINDOWS\system32\rar.exe
2008-07-17 10:00 . 2008-07-17 10:00 <DIR> d-------- C:\Program Files\CCleaner
2008-07-13 14:10 . 2008-07-13 14:10 <DIR> d-------- C:\Program Files\Softronics
2008-07-13 14:10 . 2008-07-17 20:23 112 --a------ C:\WINDOWS\LOGO.INI
2008-07-13 12:00 . 2008-07-17 09:48 <DIR> d-------- C:\Program Files\Apache Software Foundation
2008-07-13 11:50 . 2008-07-17 09:49 <DIR> d-------- C:\java
2008-07-11 07:58 . 2008-07-11 07:58 17,920 --a------ C:\Documents and Settings\Piku\Application Data\GDIPFONTCACHEV1.DAT
2008-07-07 21:13 . 2008-07-07 21:13 <DIR> d-------- C:\Documents and Settings\Piku\Application Data\Yahoo!
2008-07-07 21:13 . 2008-07-07 21:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-07-03 21:58 . 2004-08-04 00:56 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2008-07-03 21:58 . 2004-08-04 00:56 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
2008-07-03 21:58 . 2004-08-03 23:10 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2008-07-03 21:58 . 2004-08-03 23:10 15,360 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2008-07-03 21:58 . 2004-08-03 23:10 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2008-07-03 21:58 . 2004-08-03 23:10 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
2008-07-03 21:58 . 2004-08-03 23:10 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2008-07-03 21:58 . 2004-08-03 23:10 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2008-07-03 21:58 . 2004-08-03 22:58 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2008-07-03 21:58 . 2004-08-03 22:58 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2008-07-03 21:56 . 2008-07-03 21:57 <DIR> d-------- C:\Program Files\Common Files\snpstd3
2008-07-03 21:56 . 2008-07-03 21:56 <DIR> d-------- C:\Documents and Settings\Piku\Application Data\InstallShield
2008-07-03 21:56 . 2007-07-25 17:23 10,375,552 --a------ C:\WINDOWS\system32\drivers\snpstd3.sys
2008-07-03 21:56 . 2007-07-23 18:04 155,648 --a------ C:\WINDOWS\system32\rsnpstd3.dll
2008-07-03 21:56 . 2007-07-23 18:09 57,344 --a------ C:\WINDOWS\system32\vsnpstd3.dll
2008-07-03 21:56 . 2005-11-23 13:55 53,248 --a------ C:\WINDOWS\system32\csnpstd3.dll
2008-07-03 21:56 . 2005-11-23 13:55 53,248 --a------ C:\WINDOWS\csnpstd3.dll
2008-07-03 20:38 . 2008-07-06 06:17 734,365,696 --a------ C:\g3 - live in denver - joe satriani, steve vai, yngwie malmst.avi
2008-07-03 14:05 . 2008-07-06 01:25 1,440,960 --a------ C:\john petrucci extreme impossible guitar lesson.flv
2008-07-03 10:40 . 2008-07-03 10:40 <DIR> d-------- C:\Documents and Settings\Piku\Application Data\Media Player Classic
2008-07-02 22:59 . 2008-07-02 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-02 22:55 . 2008-07-02 22:58 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-28 19:21 . 2008-07-13 13:31 <DIR> d-------- C:\jsp_prog
2008-06-28 09:00 . 2008-06-28 09:00 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-06-27 23:22 . 2008-06-27 23:22 <DIR> d-------- C:\Documents and Settings\Piku\Application Data\JCreator
2008-06-27 23:22 . 2008-06-27 23:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\JCreator
2008-06-27 23:20 . 2008-06-27 23:20 <DIR> d-------- C:\Program Files\Xinox Software
2008-06-27 23:20 . 2008-07-20 10:29 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-26 19:49 . 2008-07-16 11:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-26 19:49 . 2008-06-26 19:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-25 21:41 . 2008-06-25 21:41 <DIR> d-------- C:\Program Files\Google
2008-06-24 10:15 . 2008-07-20 00:07 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-06-23 20:40 . 2008-06-23 20:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LightScribe
2008-06-23 20:37 . 2008-06-23 20:37 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-06-23 20:37 . 2008-06-24 16:22 <DIR> d-------- C:\Documents and Settings\Piku\Application Data\Ahead
2008-06-23 20:34 . 2008-06-23 20:34 <DIR> d-------- C:\Program Files\Nero
2008-06-23 20:34 . 2008-06-23 20:37 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-06-23 20:34 . 2008-06-23 20:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 04:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-18 12:48 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-06-16 03:42 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-06-11 07:50 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.61-8876480L.exe
2008-06-11 07:50 --------- d-----w C:\Program Files\Logitech
2008-06-11 07:49 --------- d-----w C:\Program Files\Common Files\Logitech
2008-06-11 07:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-11 07:46 --------- d-----w C:\Documents and Settings\Piku\Application Data\vlc
2008-06-11 07:36 --------- d-----w C:\Program Files\eLitecore
2008-06-11 07:32 --------- d-----w C:\Program Files\Alwil Software
2008-06-11 07:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-06-11 06:43 --------- d-----w C:\Program Files\Sigmatel Audio
2008-06-11 06:41 --------- d-----w C:\Program Files\Intel
2008-06-11 06:37 --------- d-----w C:\Program Files\MSXML 4.0
2008-06-11 06:30 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-11 06:22 --------- d-----w C:\Program Files\Windows Plus
2006-04-21 12:13 2,895,168 ----a-w C:\Program Files\FoxitReader.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 04:04 59392]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-08 06:55 7561216]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-08 06:55 86016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 04:49 79224]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 09:33 892928]
"SigmatelSysTrayApp"="sttray.exe" [2006-05-26 20:28 282624 C:\WINDOWS\sttray.exe]
"nwiz"="nwiz.exe" [2006-08-08 06:55 1519616 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
24Online Client.lnk - C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe [2003-12-17 12:10:02 245760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-05-04 10:39 149040 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 2007-07-11 16:09 20480 C:\WINDOWS\FixCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 2007-01-02 02:52 3739648 C:\Program Files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-04-19 13:26 484904 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-04 01:06 1667584 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-05-04 10:59 161328 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2007-05-10 13:18 835584 C:\WINDOWS\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnpstd3]
--a------ 2007-04-21 09:32 270336 C:\WINDOWS\tsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
--------- 2004-03-03 15:20 19968 C:\WINDOWS\LOGI_MWX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 04:50]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 04:46]
S3 PciCon;PciCon;F:\PciCon.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4be4237b-4e84-11dd-91f0-0019d1239d4b}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{599d2ed8-41b4-11dd-91aa-0019d1239d4b}]
\Shell\AutoRun\command - ntdetec1.exe
\Shell\explore\Command - ntdetec1.exe
\Shell\open\Command - ntdetec1.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d71c8b48-48ab-11dd-91dd-0019d1239d4b}]
\Shell\AutoRun\command - wscript.exe AVG.vbs
\Shell\open\Command - wscript.exe AVG.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d71c8b4b-48ab-11dd-91dd-0019d1239d4b}]
\Shell\AutoRun\command - wscript.exe AVG.vbs
\Shell\open\Command - wscript.exe AVG.vbs

*Newly Created Service* - CATCHME
*Newly Created Service* - SASDIFSV
*Newly Created Service* - SASENUM
*Newly Created Service* - SASKUTIL

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-ares - C:\Program Files\Ares\Ares.exe
MSConfigStartUp-ares - C:\Program Files\Ares\Ares.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-20 13:42:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-20 13:43:28
ComboFix-quarantined-files.txt 2008-07-20 08:13:24

Pre-Run: 4,285,431,808 bytes free
Post-Run: 4,293,435,392 bytes free

189

SuperAntiSpyware log :

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/20/2008 at 01:29 PM

Application Version : 4.15.1000

Core Rules Database Version : 3508
Trace Rules Database Version: 1499

Scan type : Quick Scan
Total Scan Time : 00:07:32

Memory items scanned : 374
Memory threats detected : 0
Registry items scanned : 289
Registry threats detected : 0
File items scanned : 5490
File threats detected : 0

Adware.Tracking Cookie
.indextools.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.indextools.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.warez-bb.org [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
www.warez-bb.org [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.warez-bb.org [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\Piku\Application Data\Mozilla\Firefox\Profiles\riwlwyar.default\cookies.txt ]

Waiting for a speedy reply,
Thanks and Regards

Forum Information

Currently it is Monday, September 08, 2008 2:47 AM (GMT +2)
There are a total of 61.872 posts in 15.440 threads.
In the last 3 days there were 16 new threads and 64 reply posts. View Active Threads