Problem (autorun.inf) (shellexecute=

View previous topic View next topic Go down

Solved Problem (autorun.inf) (shellexecute=

Post by ikon32 on 18th December 2008, 3:31 pm

Hi, and thanks for helping.

I have a lot of pop ups from "Adserving.cpxinteractive.com" and need some help to remove!

I have hidden files in all my hard-drives that I don't think they belong there. :hmm:
File Folder "resycled", with "boot.com" inside, which I deleted and regenerates itself...somehow.

And an "autorun.inf" not in the same folder with the lines below:
[autorun]
;gpfbagynssmnekcyxjtmlrkiajyqkussypqbwfywjrxgijdeiqulphaqfvfyepmvmivyxdrdqjzcwqjiqmmtvagozfstytnaavrv
shellexecute="resycled\boot.com j:"
;zwnaciiaryhrzljvlddqgcglhlk
shell\Open\command="resycled\boot.com j:"
;hrshpgplsvuztzdberbaedlxkkyiha

I need help to identify and remove these files if necessary.

This is the log from HijackThis v2.0.2
------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:07:52 μμ, on 18/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\EmEditor\emedtray.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\ass\Desktop\hijackgpthis.exe

continued on next post (file too big)

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 18th December 2008, 3:32 pm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {64F7142B-CD92-4CE8-ABDD-E0073F7B90AA} - C:\WINDOWS\system32\ljJDSJcd.dll (file missing)
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\tr-tr\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [] C:\Documents and Settings\ass\Application Data\Adobe\Player.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKLM\..\Policies\Explorer\Run: [] 
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - S-1-5-18 Startup: EmEditor.lnk = C:\Program Files\EmEditor\emedtray.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: EmEditor.lnk = C:\Program Files\EmEditor\emedtray.exe (User 'Default user')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - Startup: EmEditor.lnk = C:\Program Files\EmEditor\emedtray.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Free WebSite Tools.lnk = ?
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Append to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - [You must be registered and logged in to see this link.]
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{F41559A6-4EBF-48AA-A38D-C4E8C86E060C}: NameServer = 85.255.116.156;85.255.112.21
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCEA0320-75B3-4FD9-ABCF-5212FFACAEAF}: NameServer = 85.255.116.156;85.255.112.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.156;85.255.112.21
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: onfwbsak - {07EB9E1E-A819-4365-B9CC-E36D2B76F783} - (no file)
O21 - SSODL: rwlfsdmk - {F62E9644-3592-403E-867B-C2D3E767A7B1} - (no file)
O21 - SSODL: UtilChkCmd - {1D9E458C-FEBE-30FD-EC90-060B54EAEC29} - C:\Program Files\qrlvqwd\UtilChkCmd.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 18161 bytes[code]

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 18th December 2008, 4:57 pm

Hello.


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O2 - BHO: (no name) - {64F7142B-CD92-4CE8-ABDD-E0073F7B90AA} - C:\WINDOWS\system32\ljJDSJcd.dll (file missing)
    O4 - HKCU\..\Run: [] C:\Documents and Settings\ass\Application Data\Adobe\Player.exe
    O4 - HKLM\..\Policies\Explorer\Run: [] 
    O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
    O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F41559A6-4EBF-48AA-A38D-C4E8C86E060C}: NameServer = 85.255.116.156;85.255.112.21
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FCEA0320-75B3-4FD9-ABCF-5212FFACAEAF}: NameServer = 85.255.116.156;85.255.112.21
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.156;85.255.112.21
    O21 - SSODL: onfwbsak - {07EB9E1E-A819-4365-B9CC-E36D2B76F783} - (no file)
    O21 - SSODL: rwlfsdmk - {F62E9644-3592-403E-867B-C2D3E767A7B1} - (no file)
    O21 - SSODL: UtilChkCmd - {1D9E458C-FEBE-30FD-EC90-060B54EAEC29} - C:\Program Files\qrlvqwd\UtilChkCmd.dll


  • Press "Fix Checked"
  • If Zonealarm warns you of a registry change, please allow it.
  • Close Hijack This.

    then,


    • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
    • Double click on ComboFix.exe.
    • Follow the prompts. NOTE:
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
      ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


    • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



    • Allow ComboFix to download the Recovery Console.
    • Accept the End-User License Agreement.
    • The Recovery Console will be installed.
    • You will this next prompt that asks if you want to continue the malware scan, select yes



    • Allow combofix to run
    • Post C:\combofix.txt back here.

      Note:
      Do not mouseclick combofix's window whilst it's running. That may cause it to stall.



[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 18th December 2008, 6:06 pm

ComboFix 08-12-17.01 - ass 2008-12-18 19:33:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1253.1.1033.18.3071.2465 [GMT 2:00]
Running from: c:\documents and settings\ass\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\documents and settings\ass\Application Data\Adobe\Player.exe.bak
c:\documents and settings\ass\Favorites\Cheap Pharmacy Online.url
c:\program files\Mozilla Firefox\components\iamfamous.dll
C:\resycled
c:\resycled\boot.com
c:\windows\base64.tmp
c:\windows\BM77c393f9.txt
c:\windows\cookies.ini
c:\windows\IE4 Error Log.txt
c:\windows\pskt.ini
c:\windows\system32\Cache
c:\windows\system32\dcJSDJjl.ini
c:\windows\system32\dcJSDJjl.ini2
c:\windows\system32\drivers\msqpdxqawvkwtw.sys
c:\windows\system32\drivers\msqpdxserv.sys
c:\windows\system32\gcanpevw.ini
c:\windows\system32\hnxuvsmg.ini
c:\windows\system32\kadmdc.dll
c:\windows\system32\kpbapaio.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\msqpdxsratkrtj.dll
c:\windows\system32\orqfktnp.ini
c:\windows\system32\PqrXxGgh.ini
c:\windows\system32\PqrXxGgh.ini2
c:\windows\system32\qmofsspj.ini
c:\windows\system32\qroeihbc.ini
c:\windows\system32\qtyixogr.ini
c:\windows\system32\rexplycr.ini
c:\windows\system32\xbiulcnq.ini
c:\windows\zip1.tmp
c:\windows\zip2.tmp
c:\windows\zip3.tmp
c:\windows\zipped.tmp
G:\autorun.inf
G:\resycled
g:\resycled\boot.com
H:\Autorun.inf
H:\resycled
h:\resycled\boot.com
I:\Autorun.inf
I:\resycled
i:\resycled\boot.com
J:\Autorun.inf
J:\resycled
j:\resycled\boot.com
L:\autorun.inf
L:\resycled
l:\resycled\boot.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSQPDXSERV.SYS
-------\Legacy_MSQPDXSERV.SYS


((((((((((((((((((((((((( Files Created from 2008-11-18 to 2008-12-18 )))))))))))))))))))))))))))))))
.

2008-12-18 05:38 . 2008-12-18 05:38 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-18 05:38 . 2008-12-18 05:38 1,409 --a------ c:\windows\QTFont.for
2008-12-17 14:48 . 2008-12-17 14:48 d-------- c:\program files\Panda Security
2008-12-17 14:48 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-16 12:09 . 2008-12-16 12:15 d-------- c:\documents and settings\ass\Application Data\My Battle for Middle-earth(tm) II Files
2008-12-16 01:18 . 2008-12-16 01:18 d-------- c:\windows\system32\AGEIA
2008-12-16 01:18 . 2008-12-16 03:48 d-------- c:\windows\NV24043392.TMP
2008-12-16 01:18 . 2008-12-16 01:18 d-------- c:\program files\AGEIA Technologies
2008-12-16 01:18 . 2008-11-13 16:20 203,540 --a------ c:\windows\system32\nvapps.nvb
2008-12-15 20:51 . 2008-12-16 03:48 d-------- c:\windows\NV39721816.TMP
2008-12-15 16:37 . 2008-12-15 16:47 d-------- c:\windows\NV30003140.TMP
2008-12-15 16:33 . 2008-12-18 19:50 193,879 --a------ c:\windows\system32\nvapps.xml
2008-12-15 16:31 . 2008-12-16 03:48 d-------- c:\windows\nview
2008-12-15 16:31 . 2008-12-15 16:48 d-------- c:\windows\NV28441992.TMP
2008-12-14 06:10 . 2008-12-14 06:10 d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-14 06:09 . 2008-12-14 06:09 d-------- c:\program files\SUPERAntiSpyware
2008-12-14 06:09 . 2008-12-16 01:18 d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-14 06:09 . 2008-12-14 06:09 d-------- c:\documents and settings\ass\Application Data\SUPERAntiSpyware.com
2008-12-13 22:21 . 2008-12-13 23:44 d-------- c:\program files\CA Yahoo! Anti-Spy
2008-12-13 12:03 . 2008-12-13 12:03 d-------- c:\documents and settings\All Users\Application Data\OptiTex
2008-12-13 12:01 . 2008-10-16 09:14 10,137,600 --a------ c:\windows\system32\dzcore.dll
2008-12-13 12:01 . 2008-10-16 08:36 6,131,712 --a------ c:\windows\system32\daz-qt-mt.dll
2008-12-13 12:01 . 2008-10-16 08:28 2,076,672 --a------ c:\windows\system32\dz3delight.dll
2008-12-13 12:01 . 2008-10-16 08:36 1,785,856 --a------ c:\windows\system32\daz-qsa.dll
2008-12-13 12:01 . 2008-10-16 09:17 49,152 --a------ c:\windows\system32\dzcarrara.dll
2008-12-13 12:01 . 2008-10-16 09:17 33,280 --a------ c:\windows\system32\dzbryce6.dll
2008-12-13 12:01 . 2008-10-16 09:17 26,624 --a------ c:\windows\system32\dzwrapper.dll
2008-12-12 11:53 . 2008-12-12 11:53 d-------- c:\program files\Electronic Arts
2008-12-12 05:36 . 2008-12-12 05:36 d-------- c:\documents and settings\ass\Application Data\Ambient Design
2008-12-12 05:34 . 2008-12-12 05:34 d-------- c:\program files\Ambient Design
2008-12-12 02:40 . 2008-12-12 02:40 d-------- c:\program files\DAZ
2008-12-09 10:26 . 2008-12-13 07:22 d-------- c:\program files\Common Files\DAZ
2008-12-07 14:32 . 2008-12-07 14:32 d-------- c:\documents and settings\ass\Application Data\e frontier
2008-12-06 11:47 . 2008-12-06 15:31 d-------- c:\documents and settings\ass\Application Data\Poser 7
2008-12-06 07:04 . 2004-03-29 17:23 90,112 --a------ c:\windows\unvise32.exe
2008-12-06 06:30 . 2008-12-07 14:30 d-------- c:\program files\e frontier
2008-12-05 07:11 . 2008-12-05 07:11 d-------- c:\program files\Common Files\Intel
2008-12-05 06:14 . 2008-12-13 07:27 d-------- c:\program files\Amara - Flash Slide Show Builder
2008-12-05 06:09 . 2008-12-05 06:11 d-------- c:\program files\Amara - Flash News Ticker
2008-12-05 06:02 . 2008-12-05 06:08 d-------- c:\program files\Amara - Flash Photo Animation Software
2008-12-05 05:53 . 2008-12-05 06:02 d-------- c:\program files\Amara - Flash Menu Builder
2008-12-02 09:16 . 2008-12-02 09:16 d-------- c:\documents and settings\mike\Application Data\Yahoo!
2008-12-02 09:06 . 2008-12-02 09:06 d-------- c:\documents and settings\mike\Application Data\Windows Desktop Search
2008-12-02 08:35 . 2008-12-02 08:35 d-------- c:\documents and settings\mike\Program Files
2008-12-02 08:35 . 2008-12-02 19:20 d-------- c:\documents and settings\mike\Application Data\DNA
2008-12-02 08:34 . 2008-12-02 19:29 d-------- c:\documents and settings\mike
2008-11-29 03:14 . 2008-11-29 03:33 d-------- c:\documents and settings\Administrator
2008-11-29 03:02 . 2008-11-29 03:02 d-------- c:\windows\SQLTools9_KB948109_ENU
2008-11-29 03:00 . 2008-11-29 03:00 d-------- c:\windows\SQL9_KB948109_ENU
2008-11-29 02:39 . 2008-11-29 09:12 d-------- c:\program files\InstantCD+DVD
2008-11-29 02:39 . 1998-06-17 09:00 385,100 --a------ c:\windows\system32\MSVCRTD.DLL
2008-11-29 02:39 . 2002-07-23 10:11 152,576 --a------ c:\windows\system32\IWUninstall.exe
2008-11-29 02:39 . 1998-06-17 09:00 94,285 --a------ c:\windows\system32\MSVCIRTD.DLL
2008-11-26 14:23 . 2008-11-26 14:23 18,448 --a------ c:\windows\system32can4d
2008-11-26 14:22 . 2008-11-26 14:23 d-------- c:\documents and settings\All Users\Application Data\SSScanWizard
2008-11-26 14:22 . 2008-11-26 14:22 d-------- c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2008-11-20 10:00 . 2008-11-20 10:00 d-------- c:\program files\Business Objects
2008-11-20 09:54 . 2008-11-20 09:54 d-------- c:\program files\MSXML 6.0
2008-11-20 09:50 . 2008-11-29 03:02 d-------- c:\program files\Microsoft SQL Server
2008-11-20 09:49 . 2008-11-20 09:49 d-------- c:\program files\Microsoft Device Emulator
2008-11-20 09:47 . 2008-11-20 09:48 d-------- c:\program files\Windows Mobile 5.0 SDK R2
2008-11-20 09:46 . 2008-11-20 09:46 d-------- c:\program files\Microsoft Synchronization Services
2008-11-20 09:46 . 2008-11-20 09:46 d-------- c:\program files\Microsoft SQL Server Compact Edition
2008-11-20 09:35 . 2008-11-20 09:35 d-------- c:\documents and settings\All Users\Application Data\PreEmptive Solutions
2008-11-20 09:30 . 2008-11-20 09:30 d-------- c:\windows\symbols
2008-11-20 09:28 . 2008-11-20 09:28 d-------- c:\program files\Microsoft SDKs
2008-11-20 09:28 . 2008-11-20 09:31 d-------- c:\program files\HTML Help Workshop
2008-11-20 09:28 . 2008-11-20 09:35 d-------- c:\program files\Common Files\Merge Modules
2008-11-20 09:28 . 2008-11-20 09:28 d-------- c:\program files\CE Remote Tools
2008-11-20 09:27 . 2008-11-20 09:27 d-------- c:\program files\Microsoft Web Designer Tools
2008-11-20 09:27 . 2008-11-20 09:27 dr-h----- C:\MSOCache
2008-11-20 09:26 . 2008-11-29 03:03 d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-20 09:22 . 2008-11-20 09:22 d-------- c:\windows\system32\XPSViewer
2008-11-20 09:22 . 2008-11-20 09:22 d-------- c:\program files\Reference Assemblies
2008-11-20 09:22 . 2008-11-20 09:30 d-------- c:\program files\MSBuild
2008-11-20 09:21 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-11-18 11:44 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-18 17:50 --------- d-----w c:\program files\DNA
2008-12-18 17:50 --------- d-----w c:\documents and settings\ass\Application Data\DNA
2008-12-18 17:45 144,296 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-18 17:45 14,227,488 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-16 21:13 --------- d-----w c:\documents and settings\ass\Application Data\BitTorrent
2008-12-16 10:01 --------- d-----w c:\program files\PowerArchiver
2008-12-16 08:04 --------- d-----w c:\documents and settings\ass\Application Data\LimeWire
2008-12-15 11:51 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-13 20:21 --------- d-----w c:\program files\Yahoo!
2008-12-13 20:21 --------- d-----w c:\program files\Common Files\Scanner
2008-12-06 06:31 --------- d-----w c:\program files\PowerZip
2008-12-06 06:12 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-03 05:55 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-26 12:21 --------- d-----w c:\documents and settings\All Users\Application Data\ScanSoft
2008-11-20 16:08 --------- d-----w c:\program files\EA Sports
2008-11-20 07:57 --------- d-----w c:\program files\Microsoft.NET
2008-11-17 16:50 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-17 16:50 22,328 ----a-w c:\documents and settings\ass\Application Data\PnkBstrK.sys
2008-11-15 13:09 --------- d-----w c:\program files\BitTorrent
2008-11-13 12:05 --------- d-----w c:\documents and settings\ass\Application Data\Nero
2008-11-13 11:59 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-11-13 01:20 --------- d-----w c:\program files\Norton 360
2008-11-12 12:54 6,188,320 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2008-11-11 09:18 --------- d-----w c:\program files\Common Files\Nero
2008-11-11 09:04 --------- d-----w c:\program files\Nero
2008-11-11 09:02 --------- d-----w c:\program files\Windows Sidebar
2008-11-09 11:47 --------- d-----w c:\program files\Elaborate Bytes
2008-10-25 21:49 --------- d-----w c:\program files\DAEMON Tools Toolbar
2008-10-25 21:49 --------- d-----w c:\program files\DAEMON Tools Lite
2008-10-25 21:41 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-10-25 21:40 --------- d-----w c:\documents and settings\ass\Application Data\DAEMON Tools
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-22 15:14 --------- d-----w c:\documents and settings\ass\Application Data\Symantec
2008-10-22 09:17 --------- d-----w c:\program files\Common Files\Adobe
2008-10-21 00:11 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-19 10:36 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-10-19 10:36 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-10-19 10:36 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-10-19 10:36 --------- d-----w c:\program files\Symantec
2008-10-19 10:27 --------- d-----w c:\program files\Windows Defender
2008-10-18 22:51 --------- d-----w c:\documents and settings\All Users\Application Data\SITEguard
2008-10-18 21:30 --------- d-----w c:\program files\ZoneAlarmSB
2008-10-18 21:28 --------- d-----w c:\program files\Zone Labs
2008-10-18 11:02 --------- d-----w c:\documents and settings\ass\Application Data\Windows Search
2008-10-18 10:50 --------- d-----w c:\documents and settings\ass\Application Data\Windows Desktop Search
2008-10-18 10:49 --------- d-----w c:\program files\Windows Desktop Search
2008-10-10 22:47 90,112 ----a-w c:\windows\DUMP804b.tmp
2008-09-09 20:51 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-08-30 19:29 0 ----a-w c:\program files\temp01
.

------- Sigcheck -------

2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2006-02-28 14:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtServicePackUninstall$\tcpip.sys
2008-07-01 05:18 361344 8e036eec565910417ea020ce0962aa24 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-04-13 21:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\ServicePackFiles\i386\TCPIP.SYS
2008-08-06 16:30 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\dllcache\TCPIP.SYS
2008-08-06 16:30 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-07-06 173368]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-07-06 18:44 1164600 --a------ c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 18th December 2008, 6:06 pm

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-07-06 1164600]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"= "c:\program files\DAEMON Tools Toolbar\DTToolbar.dll" [2008-10-14 863688]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-07-06 1164600]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"= "c:\program files\DAEMON Tools Toolbar\DTToolbar.dll" [2008-10-14 863688]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CLASSES_ROOT\clsid\{32099aac-c132-4136-9e9a-4e364a424e17}]
[HKEY_CLASSES_ROOT\DTToolbar.ToolBandObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}]
[HKEY_CLASSES_ROOT\DTToolbar.ToolBandObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-01 68856]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-16 342848]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-04 1809648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"="c:\windows\system32\dumprep 0 -k" [X]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-05-19 849288]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-05-10 1298542]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-29 98304]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"MsmqIntCert"="mqrt.dll" [2008-04-14 c:\windows\system32\mqrt.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-01 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 c:\windows\Alcmtr.exe]
"nwiz"="nwiz.exe" [2008-11-12 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-18 9117696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
""="1 (0x1)" [X]

c:\documents and settings\ass\Start Menu\Programs\Startup\
EmEditor.lnk - c:\program files\EmEditor\emedtray.exe [2008-05-21 91280]
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-06-02 547840]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Free WebSite Tools.lnk - c:\program files\CoffeeCup Software\CoffeeCup Free Viewer Plus\ThirtyDayTimer.exe [2008-06-03 372224]
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]
Monitor Apache Servers.lnk - c:\program files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe [2008-06-13 41041]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-05-29 118784]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HideClock"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideClock"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2008-04-18 01:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
-ra------ 2008-07-06 18:32 111928 c:\program files\SweetIM\Messenger\SweetIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\MagicDisc\\MagicDisc.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-17 28544]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R2 Apache2.2;Apache2.2;"c:\program files\Apache Software Foundation\Apache2.2\bin\httpd.exe" -k runservice [2008-06-13 24635]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-10-19 99376]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S0 ElbyVCD;ElbyVCD;c:\windows\system32\DRIVERS\ElbyVCD.sys []
S2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6; []
S3 GPU-Z;GPU-Z;\??\c:\docume~1\ass\LOCALS~1\Temp\GPU-Z.sys []

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 18th December 2008, 6:07 pm

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5c08fa6f-81ff-11dd-93af-00e1a7767681}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7454be84-cb30-11dd-8e3b-00e1a7767681}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com d:
\Shell\Open\command - d:\resycled\boot.com d:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4ea654e-5f16-11dd-9385-00e1a7767681}]
\Shell\auto\command - L:\Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - L:\Knight.exe open
\Shell\find\command - L:\Knight.exe open
\Shell\install\command - L:\Knight.exe open
\Shell\open\command - L:\Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e7c5ec9b-6c9d-11dd-939c-00e1a7767681}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-12-18 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-SITEguard - (no file)
HKLM-Run-LogitechVideoRepair - c:\program files\Logitech\Video\ISStart.exe
HKLM-Run-SNM - c:\program files\SpyNoMore\SNM.exe
HKU-Default-RunOnce- - (no file)


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\sysreqlab_srl.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
[You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\sysreqlab.osd
FF - ProfilePath - c:\documents and settings\ass\Application Data\Mozilla\Firefox\Profiles\5v254oji.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\ass\Application Data\Mozilla\Firefox\Profiles\5v254oji.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
FF - component: c:\documents and settings\ass\Application Data\Mozilla\Firefox\Profiles\5v254oji.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\components\iamfamous.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.version", 3);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.3.shown", false);
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
piffile="%1" %*"
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-18 19:48:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1040)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\incdsrv.exe
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\windows\system32\msdtc.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\snmp.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\mqsvc.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-12-18 19:59:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-18 17:59:44

Pre-Run: 13,522,112,512 bytes free
Post-Run: 14,658,793,472 bytes free

449 --- E O F --- 2008-12-13 01:04:53

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 18th December 2008, 6:09 pm

That was the log, Thank you for your help...

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 18th December 2008, 7:35 pm

Hello.
Please bare with me on this, this malware maybe new and has attacked Firefox, and I aren't aware of an automatic fix for this yet.

Open Firefox, and type this in the URL bar: about:config
This will bring up a warning about the Firefox control panel and will warn you, but press "I'll be careful, I promise"

Now this will open Firefox's hidden control panel, scroll down the list (it's in alphabetic order, so easy to find) to find this entry. browser.rights.3, it should currently be set to "false"
Double click it and it will be set to "true"

Now close Firefox.


Now open a new notepad file.
Input this into the notepad file:

File::
c:\documents and settings\Judy\nah_kyfa.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HideClock"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideClock"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5c08fa6f-81ff-11dd-93af-00e1a7767681}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7454be84-cb30-11dd-8e3b-00e1a7767681}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4ea654e-5f16-11dd-9385-00e1a7767681}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e7c5ec9b-6c9d-11dd-939c-00e1a7767681}]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

Once CF has done it's run and you have the new log, DO NOT open any of your flash drives in Windows Explorer <-- Important!!

Next,

Please download Flash_Disinfector from [You must be registered and logged in to see this link.]

  • First, download it to your desktop.
  • Now double click it to run it and will tell it you what to do when you open it.
  • It will temporarily kill explorer.exe and your desktop will go blank.
  • Let Flash_Disinfector do it's job and it will restart explorer.exe for you.
  • It will make a dummy autorun.inf in the root of every drive.
  • You can now delete Flash_Disinfector.exe.


Now paste the resulting new combofix log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 8:03 am

Sorry for the delay, (something I could'nt avoid) I'll be online for the next Xtime until this is done...
Thanks for your help.
This is the last CF log before I ran "Flash_Disin..."

ComboFix 08-12-17.01 - ass 2008-12-19 9:43:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1253.1.1033.18.3071.2341 [GMT 2:00]
Running from: c:\documents and settings\ass\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ass\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\documents and settings\Judy\nah_kyfa.exe
.

((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-18 05:38 . 2008-12-18 05:38 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-18 05:38 . 2008-12-18 05:38 1,409 --a------ c:\windows\QTFont.for
2008-12-17 14:48 . 2008-12-17 14:48 d-------- c:\program files\Panda Security
2008-12-17 14:48 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-16 12:09 . 2008-12-16 12:15 d-------- c:\documents and settings\ass\Application Data\My Battle for Middle-earth(tm) II Files
2008-12-16 01:18 . 2008-12-16 01:18 d-------- c:\windows\system32\AGEIA
2008-12-16 01:18 . 2008-12-16 03:48 d-------- c:\windows\NV24043392.TMP
2008-12-16 01:18 . 2008-12-16 01:18 d-------- c:\program files\AGEIA Technologies
2008-12-16 01:18 . 2008-11-13 16:20 203,540 --a------ c:\windows\system32\nvapps.nvb
2008-12-15 20:51 . 2008-12-16 03:48 d-------- c:\windows\NV39721816.TMP
2008-12-15 16:37 . 2008-12-15 16:47 d-------- c:\windows\NV30003140.TMP
2008-12-15 16:33 . 2008-12-19 08:48 193,879 --a------ c:\windows\system32\nvapps.xml
2008-12-15 16:31 . 2008-12-16 03:48 d-------- c:\windows\nview
2008-12-15 16:31 . 2008-12-15 16:48 d-------- c:\windows\NV28441992.TMP
2008-12-14 06:10 . 2008-12-14 06:10 d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-14 06:09 . 2008-12-14 06:09 d-------- c:\program files\SUPERAntiSpyware
2008-12-14 06:09 . 2008-12-16 01:18 d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-14 06:09 . 2008-12-14 06:09 d-------- c:\documents and settings\ass\Application Data\SUPERAntiSpyware.com
2008-12-13 22:21 . 2008-12-13 23:44 d-------- c:\program files\CA Yahoo! Anti-Spy
2008-12-13 12:03 . 2008-12-13 12:03 d-------- c:\documents and settings\All Users\Application Data\OptiTex
2008-12-13 12:01 . 2008-10-16 09:14 10,137,600 --a------ c:\windows\system32\dzcore.dll
2008-12-13 12:01 . 2008-10-16 08:36 6,131,712 --a------ c:\windows\system32\daz-qt-mt.dll
2008-12-13 12:01 . 2008-10-16 08:28 2,076,672 --a------ c:\windows\system32\dz3delight.dll
2008-12-13 12:01 . 2008-10-16 08:36 1,785,856 --a------ c:\windows\system32\daz-qsa.dll
2008-12-13 12:01 . 2008-10-16 09:17 49,152 --a------ c:\windows\system32\dzcarrara.dll
2008-12-13 12:01 . 2008-10-16 09:17 33,280 --a------ c:\windows\system32\dzbryce6.dll
2008-12-13 12:01 . 2008-10-16 09:17 26,624 --a------ c:\windows\system32\dzwrapper.dll
2008-12-12 11:53 . 2008-12-12 11:53 d-------- c:\program files\Electronic Arts
2008-12-12 05:36 . 2008-12-12 05:36 d-------- c:\documents and settings\ass\Application Data\Ambient Design
2008-12-12 05:34 . 2008-12-12 05:34 d-------- c:\program files\Ambient Design
2008-12-12 02:40 . 2008-12-12 02:40 d-------- c:\program files\DAZ
2008-12-09 10:26 . 2008-12-13 07:22 d-------- c:\program files\Common Files\DAZ
2008-12-07 14:32 . 2008-12-07 14:32 d-------- c:\documents and settings\ass\Application Data\e frontier
2008-12-06 11:47 . 2008-12-06 15:31 d-------- c:\documents and settings\ass\Application Data\Poser 7
2008-12-06 07:04 . 2004-03-29 17:23 90,112 --a------ c:\windows\unvise32.exe
2008-12-06 06:30 . 2008-12-07 14:30 d-------- c:\program files\e frontier
2008-12-05 07:11 . 2008-12-05 07:11 d-------- c:\program files\Common Files\Intel
2008-12-05 06:14 . 2008-12-13 07:27 d-------- c:\program files\Amara - Flash Slide Show Builder
2008-12-05 06:09 . 2008-12-05 06:11 d-------- c:\program files\Amara - Flash News Ticker
2008-12-05 06:02 . 2008-12-05 06:08 d-------- c:\program files\Amara - Flash Photo Animation Software
2008-12-05 05:53 . 2008-12-05 06:02 d-------- c:\program files\Amara - Flash Menu Builder
2008-12-02 09:16 . 2008-12-02 09:16 d-------- c:\documents and settings\mike\Application Data\Yahoo!
2008-12-02 09:06 . 2008-12-02 09:06 d-------- c:\documents and settings\mike\Application Data\Windows Desktop Search
2008-12-02 08:35 . 2008-12-02 08:35 d-------- c:\documents and settings\mike\Program Files
2008-12-02 08:35 . 2008-12-02 19:20 d-------- c:\documents and settings\mike\Application Data\DNA
2008-12-02 08:34 . 2008-12-02 19:29 d-------- c:\documents and settings\mike
2008-11-29 03:14 . 2008-11-29 03:33 d-------- c:\documents and settings\Administrator
2008-11-29 03:02 . 2008-11-29 03:02 d-------- c:\windows\SQLTools9_KB948109_ENU
2008-11-29 03:00 . 2008-11-29 03:00 d-------- c:\windows\SQL9_KB948109_ENU
2008-11-29 02:39 . 2008-11-29 09:12 d-------- c:\program files\InstantCD+DVD
2008-11-29 02:39 . 1998-06-17 09:00 385,100 --a------ c:\windows\system32\MSVCRTD.DLL
2008-11-29 02:39 . 2002-07-23 10:11 152,576 --a------ c:\windows\system32\IWUninstall.exe
2008-11-29 02:39 . 1998-06-17 09:00 94,285 --a------ c:\windows\system32\MSVCIRTD.DLL
2008-11-26 14:23 . 2008-11-26 14:23 18,448 --a------ c:\windows\system32can4d
2008-11-26 14:22 . 2008-11-26 14:23 d-------- c:\documents and settings\All Users\Application Data\SSScanWizard
2008-11-26 14:22 . 2008-11-26 14:22 d-------- c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2008-11-20 10:00 . 2008-11-20 10:00 d-------- c:\program files\Business Objects
2008-11-20 09:54 . 2008-11-20 09:54 d-------- c:\program files\MSXML 6.0
2008-11-20 09:50 . 2008-11-29 03:02 d-------- c:\program files\Microsoft SQL Server
2008-11-20 09:49 . 2008-11-20 09:49 d-------- c:\program files\Microsoft Device Emulator
2008-11-20 09:47 . 2008-11-20 09:48 d-------- c:\program files\Windows Mobile 5.0 SDK R2
2008-11-20 09:46 . 2008-11-20 09:46 d-------- c:\program files\Microsoft Synchronization Services
2008-11-20 09:46 . 2008-11-20 09:46 d-------- c:\program files\Microsoft SQL Server Compact Edition
2008-11-20 09:35 . 2008-11-20 09:35 d-------- c:\documents and settings\All Users\Application Data\PreEmptive Solutions
2008-11-20 09:30 . 2008-11-20 09:30 d-------- c:\windows\symbols
2008-11-20 09:28 . 2008-11-20 09:28 d-------- c:\program files\Microsoft SDKs
2008-11-20 09:28 . 2008-11-20 09:31 d-------- c:\program files\HTML Help Workshop
2008-11-20 09:28 . 2008-11-20 09:35 d-------- c:\program files\Common Files\Merge Modules
2008-11-20 09:28 . 2008-11-20 09:28 d-------- c:\program files\CE Remote Tools
2008-11-20 09:27 . 2008-11-20 09:27 d-------- c:\program files\Microsoft Web Designer Tools
2008-11-20 09:27 . 2008-11-20 09:27 dr-h----- C:\MSOCache
2008-11-20 09:26 . 2008-11-29 03:03 d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-20 09:22 . 2008-11-20 09:22 d-------- c:\windows\system32\XPSViewer
2008-11-20 09:22 . 2008-11-20 09:22 d-------- c:\program files\Reference Assemblies
2008-11-20 09:22 . 2008-11-20 09:30 d-------- c:\program files\MSBuild
2008-11-20 09:21 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll

.

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 8:04 am

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-19 06:50 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-19 06:48 --------- d-----w c:\program files\DNA
2008-12-19 06:48 --------- d-----w c:\documents and settings\ass\Application Data\DNA
2008-12-19 06:45 3,258,880 ----a-w c:\windows\Internet Logs\xDB16.tmp
2008-12-19 06:45 1,849,856 ----a-w c:\windows\Internet Logs\xDB17.tmp
2008-12-19 01:07 145,832 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-19 01:07 14,227,488 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-16 23:24 100,352 ----a-w c:\windows\Internet Logs\xDB14.tmp
2008-12-16 23:24 1,842,688 ----a-w c:\windows\Internet Logs\xDB15.tmp
2008-12-16 21:26 3,083,776 ----a-w c:\windows\Internet Logs\xDB13.tmp
2008-12-16 21:13 --------- d-----w c:\documents and settings\ass\Application Data\BitTorrent
2008-12-16 10:01 --------- d-----w c:\program files\PowerArchiver
2008-12-16 08:04 --------- d-----w c:\documents and settings\ass\Application Data\LimeWire
2008-12-15 18:22 591,360 ----a-w c:\windows\Internet Logs\xDB11.tmp
2008-12-15 18:22 1,837,568 ----a-w c:\windows\Internet Logs\xDB12.tmp
2008-12-15 13:57 3,353,600 ----a-w c:\windows\Internet Logs\xDBF.tmp
2008-12-15 13:57 1,833,472 ----a-w c:\windows\Internet Logs\xDB10.tmp
2008-12-14 04:56 7,253,418 ----a-w c:\windows\Internet Logs\tvDebug.zip
2008-12-13 20:21 --------- d-----w c:\program files\Yahoo!
2008-12-13 20:21 --------- d-----w c:\program files\Common Files\Scanner
2008-12-06 10:37 3,141,120 ----a-w c:\windows\Internet Logs\xDBE.tmp
2008-12-06 06:31 --------- d-----w c:\program files\PowerZip
2008-12-06 06:12 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-05 03:21 3,143,680 ----a-w c:\windows\Internet Logs\xDBC.tmp
2008-12-05 03:21 1,774,080 ----a-w c:\windows\Internet Logs\xDBD.tmp
2008-12-03 05:55 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-26 12:21 --------- d-----w c:\documents and settings\All Users\Application Data\ScanSoft
2008-11-20 16:08 --------- d-----w c:\program files\EA Sports
2008-11-20 07:57 --------- d-----w c:\program files\Microsoft.NET
2008-11-20 01:46 3,121,152 ----a-w c:\windows\Internet Logs\xDBB.tmp
2008-11-18 20:30 3,083,264 ----a-w c:\windows\Internet Logs\xDB9.tmp
2008-11-18 20:29 1,683,456 ----a-w c:\windows\Internet Logs\xDBA.tmp
2008-11-18 09:14 3,378,688 ----a-w c:\windows\Internet Logs\xDB7.tmp
2008-11-18 09:14 1,671,680 ----a-w c:\windows\Internet Logs\xDB8.tmp
2008-11-17 16:50 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-17 16:50 22,328 ----a-w c:\documents and settings\ass\Application Data\PnkBstrK.sys
2008-11-17 16:50 103,736 ----a-w c:\windows\system32\PnkBstrB.exe
2008-11-17 16:49 669,184 ----a-w c:\windows\system32\pbsvc.exe
2008-11-17 16:49 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-11-15 13:09 --------- d-----w c:\program files\BitTorrent
2008-11-13 12:05 --------- d-----w c:\documents and settings\ass\Application Data\Nero
2008-11-13 11:59 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-11-13 01:20 --------- d-----w c:\program files\Norton 360
2008-11-12 11:45 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-11-11 09:18 --------- d-----w c:\program files\Common Files\Nero
2008-11-11 09:04 --------- d-----w c:\program files\Nero
2008-11-11 09:02 --------- d-----w c:\program files\Windows Sidebar
2008-11-10 10:25 3,140,608 ----a-w c:\windows\Internet Logs\xDB5.tmp
2008-11-10 10:25 1,553,920 ----a-w c:\windows\Internet Logs\xDB6.tmp
2008-11-09 21:42 3,205,120 ----a-w c:\windows\Internet Logs\xDB3.tmp
2008-11-09 21:42 1,542,656 ----a-w c:\windows\Internet Logs\xDB4.tmp
2008-11-09 11:47 --------- d-----w c:\program files\Elaborate Bytes
2008-10-25 21:50 4,429,312 ----a-w c:\windows\Internet Logs\xDB1.tmp
2008-10-25 21:50 1,475,584 ----a-w c:\windows\Internet Logs\xDB2.tmp
2008-10-25 21:49 --------- d-----w c:\program files\DAEMON Tools Toolbar
2008-10-25 21:49 --------- d-----w c:\program files\DAEMON Tools Lite
2008-10-25 21:41 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-10-25 21:40 --------- d-----w c:\documents and settings\ass\Application Data\DAEMON Tools
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-22 15:14 --------- d-----w c:\documents and settings\ass\Application Data\Symantec
2008-10-22 09:17 --------- d-----w c:\program files\Common Files\Adobe
2008-10-21 00:11 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-19 10:36 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-10-19 10:36 60,800 ----a-w c:\windows\system32\S32EVNT1.DLL
2008-10-19 10:36 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-10-19 10:36 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-10-19 10:36 --------- d-----w c:\program files\Symantec
2008-10-19 10:27 --------- d-----w c:\program files\Windows Defender
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 12:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 12:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 12:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-13 07:56 70,936 ----a-w c:\windows\system32\PhysXLoader.dll
2008-10-11 15:16 68,778 ----a-w c:\windows\Internet Logs\zlclient_2nd_2008_10_11_18_12_00_small.dmp.zip
2008-10-11 06:39 66,551 ----a-w c:\windows\Internet Logs\zlclient_2nd_2008_10_11_08_41_32_small.dmp.zip
2008-10-11 06:39 65,881 ----a-w c:\windows\Internet Logs\zlclient_2nd_2008_10_11_08_41_33_small.dmp.zip
2008-10-10 22:47 90,112 ----a-w c:\windows\DUMP804b.tmp
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 14:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-09 20:51 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-08-30 19:29 0 ----a-w c:\program files\temp01
.

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 8:05 am

------- Sigcheck -------

2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2006-02-28 14:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtServicePackUninstall$\tcpip.sys
2008-07-01 05:18 361344 8e036eec565910417ea020ce0962aa24 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-04-13 21:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\ServicePackFiles\i386\TCPIP.SYS
2008-08-06 16:30 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\dllcache\TCPIP.SYS
2008-08-06 16:30 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-17 00:08:40 3,593,216 -c----w c:\windows\ie7updates\KB960714-IE7\mshtml.dll
+ 2007-03-06 01:22:39 213,216 -c----w c:\windows\ie7updates\KB960714-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c----w c:\windows\ie7updates\KB960714-IE7\spuninst\updspapi.dll
- 2008-10-17 00:08:40 3,593,216 -c----w c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-13 06:40:02 3,593,216 -c----w c:\windows\system32\dllcache\mshtml.dll
- 2008-12-18 17:49:27 237,139 ----a-w c:\windows\system32\inetsrv\MetaBase.bin
+ 2008-12-19 06:49:21 237,120 ----a-w c:\windows\system32\inetsrv\MetaBase.bin
- 2008-10-17 00:08:40 3,593,216 ----a-w c:\windows\system32\mshtml.dll
+ 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll
+ 2008-12-19 06:48:34 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_e78.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-07-06 173368]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-07-06 18:44 1164600 --a------ c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-07-06 1164600]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-07-06 1164600]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-01 68856]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-16 342848]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-04 1809648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"="c:\windows\system32\dumprep 0 -k" [X]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-05-19 849288]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2006-02-28 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-05-10 1298542]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-29 98304]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"MsmqIntCert"="mqrt.dll" [2008-04-14 c:\windows\system32\mqrt.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-01 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 c:\windows\Alcmtr.exe]
"nwiz"="nwiz.exe" [2008-11-12 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-18 9117696]

c:\documents and settings\ass\Start Menu\Programs\Startup\
EmEditor.lnk - c:\program files\EmEditor\emedtray.exe [2008-05-21 91280]
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-06-02 547840]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Free WebSite Tools.lnk - c:\program files\CoffeeCup Software\CoffeeCup Free Viewer Plus\ThirtyDayTimer.exe [2008-06-03 372224]
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]
Monitor Apache Servers.lnk - c:\program files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe [2008-06-13 41041]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-05-29 118784]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2008-04-18 01:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
-ra------ 2008-07-06 18:32 111928 c:\program files\SweetIM\Messenger\SweetIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\MagicDisc\\MagicDisc.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 8:05 am

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-17 28544]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R2 Apache2.2;Apache2.2;"c:\program files\Apache Software Foundation\Apache2.2\bin\httpd.exe" -k runservice [2008-06-13 24635]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-10-19 99376]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S0 ElbyVCD;ElbyVCD;c:\windows\system32\DRIVERS\ElbyVCD.sys []
S2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6; []
S3 GPU-Z;GPU-Z;\??\c:\docume~1\ass\LOCALS~1\Temp\GPU-Z.sys []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2008-12-19 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-RunOnce- - (no file)


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\sysreqlab_srl.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
[You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\sysreqlab.osd
FF - ProfilePath - c:\documents and settings\ass\Application Data\Mozilla\Firefox\Profiles\5v254oji.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\ass\Application Data\Mozilla\Firefox\Profiles\5v254oji.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
FF - component: c:\documents and settings\ass\Application Data\Mozilla\Firefox\Profiles\5v254oji.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\components\iamfamous.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.version", 3);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.3.shown", false);
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-19 09:50:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1036)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2008-12-19 9:53:20
ComboFix-quarantined-files.txt 2008-12-19 07:52:24
ComboFix2.txt 2008-12-18 17:59:50

Pre-Run: 14.393.946.112 bytes free
Post-Run: 14,383,116,288 bytes free

381 --- E O F --- 2008-12-19 01:01:27

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 9:17 am

Hello.

Please download [You must be registered and logged in to see this link.] and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt). Note: Do not run Option #2 yet.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 10:00 am

Contents of log:

GooredFix v1.5 by jpshortstuff
Log created at 11:58 on 19/12/2008 running Option #1

=====Suspect Goored Entries=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 1:06 pm

Looks good, what problem remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 1:59 pm

All the hidden files and "boot.com" are deleted, and thank you for your help on this.

I still have pop ups from "Adserving.cpxinteractive.com" any ideas on how can I turn those off, or what sould I look for...

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 2:08 pm

Hello.
Please post a new Hijack This log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 2:11 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:10:42 μμ, on 19/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\CoffeeCup Software\CoffeeCup Direct FTP\DirectFTP.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\ass\Desktop\hijackgpthis.exe

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 2:12 pm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\tr-tr\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - S-1-5-18 Startup: EmEditor.lnk = C:\Program Files\EmEditor\emedtray.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 2:12 pm

O4 - .DEFAULT Startup: EmEditor.lnk = C:\Program Files\EmEditor\emedtray.exe (User 'Default user')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - Startup: EmEditor.lnk = C:\Program Files\EmEditor\emedtray.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Free WebSite Tools.lnk = ?
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Append to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - [You must be registered and logged in to see this link.]
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - [You must be registered and logged in to see this link.]
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 16621 bytes

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 2:18 pm

Hello.
I was looking back at your CF log, were you able to do this in Firefox?


Open Firefox, and type this in the URL bar: about:config
This will bring up a warning about the Firefox control panel and will warn you, but press "I'll be careful, I promise"

Now this will open Firefox's hidden control panel, scroll down the list (it's in alphabetic order, so easy to find) to find this entry. browser.rights.3, it should currently be set to "false"
Double click it and it will be set to "true"

Now close Firefox.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 2:22 pm

It was set to tue!

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 2:53 pm

Hello.

c:\program files\Mozilla Firefox\components\

[quote]Please download DirLook by jpshortstuff from one of the following mirrors:
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
  • Double-click DirLook.exe to run it (Vista Users should right-click and select Run As Administrator...).
  • Ensure that Show Hidden Files/Folders and BBCode Ouput are both checked.
  • Copy the content of the following codebox into the main textfield:

    Code:
    c:\program files\Mozilla Firefox\components

  • Click the DirLook button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (Note: The log can also be found at C:\DirLook.txt)
Note: Scanning may take longer for large folders.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 2:59 pm

DirLook.exe v2.0 by jpshortstuff
Log created at 16:57 on 19/12/2008
==================================
Contents of "c:\program files\Mozilla Firefox\components"

---FOLDERS---

(none found)

---FILES---

aboutRights.js (2925 bytes - created on 17/12/2008 at 12:14, modified on 17/12/2008 at 12:14) --a---
aboutRobots.js (2927 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
browser.xpt (348427 bytes - created on 18/07/2008 at 16:57, modified on 17/12/2008 at 12:14) --a---
browserdirprovider.dll (23032 bytes - created on 06/09/2008 at 12:41, modified on 17/12/2008 at 12:14) --a---
brwsrcmp.dll (134648 bytes - created on 06/09/2008 at 12:41, modified on 17/12/2008 at 12:14) --a---
FeedConverter.js (25339 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
FeedProcessor.js (66215 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
FeedWriter.js (49694 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
fuelApplication.js (38238 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
jsconsole-clhandler.js (1494 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
npscriptable.xpt (415 bytes - created on 27/04/2005 at 14:14, modified on 27/04/2005 at 14:14) --a---
nsAddonRepository.js (11659 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsBadCertHandler.js (3104 bytes - created on 12/10/2008 at 14:28, modified on 18/11/2008 at 10:59) --a---
nsBlocklistService.js (27331 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsBrowserContentHandler.js (33087 bytes - created on 18/07/2008 at 16:57, modified on 17/12/2008 at 12:14) --a---
nsBrowserGlue.js (32315 bytes - created on 18/07/2008 at 16:57, modified on 17/12/2008 at 12:14) --a---
nsContentDispatchChooser.js (5005 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsContentPrefService.js (29973 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsDefaultCLH.js (6247 bytes - created on 20/07/2008 at 02:36, modified on 18/11/2008 at 10:59) --a---
nsDownloadManagerUI.js (5737 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsExtensionManager.js (333468 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsHandlerService.js (51214 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsHelperAppDlg.js (41716 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsILegitCheckPlugin.xpt (324 bytes - created on 18/10/2008 at 09:44, modified on 27/06/2008 at 12:11) --a---
nsIQTScriptablePlugin.xpt (2394 bytes - created on 06/09/2008 at 12:41, modified on 16/06/2008 at 11:26) --a---
nsLivemarkService.js (36039 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsLoginInfo.js (4302 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsLoginManager.js (44047 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsLoginManagerPrompter.js (40367 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsMicrosummaryService.js (77051 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsPlacesTransactionsService.js (33805 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsPostUpdateWin.js (21420 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsProxyAutoConfig.js (13682 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsSafebrowsingApplication.js (25176 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsSearchService.js (110646 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsSearchSuggestions.js (24273 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsSessionStartup.js (11428 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsSessionStore.js (76726 bytes - created on 18/07/2008 at 16:57, modified on 17/12/2008 at 12:14) --a---
nsSetDefaultBrowser.js (2854 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsSidebar.js (12513 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsTaggingService.js (9967 bytes - created on 06/09/2008 at 12:41, modified on 17/12/2008 at 12:14) --a---
nsTryToClose.js (3268 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
nsUpdateService.js (112848 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsUrlClassifierLib.js (50600 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsUrlClassifierListManager.js (19984 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsURLFormatter.js (3097 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---
nsWebHandlerApp.js (6920 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
pluginGlue.js (3142 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
storage-Legacy.js (49926 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
txEXSLTRegExFunctions.js (6667 bytes - created on 06/09/2008 at 12:41, modified on 18/11/2008 at 10:59) --a---
WebContentConverter.js (34011 bytes - created on 18/07/2008 at 16:57, modified on 18/11/2008 at 10:59) --a---

==================================
=EOF=

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 3:11 pm

Okay, not there this time.

Delete this folder:
C:\Qoobox

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 3:27 pm

Malwarebytes' Anti-Malware 1.31
Database version: 1520
Windows 5.1.2600 Service Pack 3

19/12/2008 5:25:34 μμ
mbam-log-2008-12-19 (17-25-34).txt

Scan type: Quick Scan
Objects scanned: 66833
Time elapsed: 4 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 25
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\gs23d1.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\kiolld (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{06360872-0310-49c1-8eda-953e73941e3e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{419803e0-ebb5-418e-bcdd-8ea63647ec5e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{10026069-7a5f-4531-811e-c8df20643bee} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\peltodgx.bmvb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\peltodgx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\olnmraew.blxw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\olnmraew.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\BM77c393f9.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\ass\Desktop\Micro Antivirus 2009.lnk (Rogue.XPertAntivirus) -> Quarantined and deleted successfully.

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 3:31 pm

Any improvement?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 3:48 pm

Yes, it's gone... Thanks alot!!!

One more advise please+++

What combination of software protection, at your opinion, is the best to use?

So that there are not any conflicts betwen the software and olso have the nacessary protection against malware, viruses, trojans, etc,

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 3:54 pm

Thank god for that.
I will post some tips after this, because your Java is outdated and right now, leaves a hole for the malware to come straight back, we need to close that hole.

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

  • Download the latest version of [You must be registered and logged in to see this link.].
  • Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 11".
  • Click the "Download" button to the right.
  • In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    - Examples of older versions in Add or Remove Programs:
    - Java 2 Runtime Environment, SE v1.4.2
    - J2SE Runtime Environment 5.0
    - J2SE Runtime Environment 5.0 Update 2
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u11-windows-i586-p.exe that you downloaded to install the newest version.
Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from [You must be registered and logged in to see this link.]

  • First, unzip it.
  • Then run JavaRa.
  • Select English from the drop down menu and press Select.
  • This will open JavaRa.
  • Press Remove older versions
  • Press yes to the prompt.
  • It will make a log file of what it's removed.
  • Copy and paste the log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 5:16 pm

JavaRa 1.12 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Fri Dec 19 19:15:11 2008

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

------------------------------------

Finished reporting.

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Belahzur on 19th December 2008, 5:18 pm

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.


Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by ikon32 on 19th December 2008, 6:27 pm

Can't tell you how much I appreciated all your help and sugestions, Thanks+++

ikon32
Novice
Novice

Posts Posts : 27
Joined Joined : 2008-12-18
OS OS : windows vista ultimate
Points Points : 29208
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Problem (autorun.inf) (shellexecute=

Post by Doctor Inferno on 24th January 2009, 10:13 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 11976
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104630
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum