Uninstall it, it is a rogue program. And delete any files/folders you find.

0

Sorry for replying late bro. I had actually installed JDK instead of JRE, so I've removed it now and installed JRE. Does it make any difference by the way? Here's the log produced by MBAM: ------------ Malwarebytes' Anti-Malware 1.25 Database version: 1062 Windows 5.1.2600 Service Pack 2 8:58:31 PM 25-Aug-08 mbam-log-08-25-2008 (20-58-31).txt Scan type: Quick Scan Objects scanned: 52937 Time elapsed: 19 minute(s), 27 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll (Trojan.Agent) -> Delete on reboot. Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll (Trojan.Agent) -> Delete on reboot.

0

Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Remember to re-enable the protection again afterwards before connecting to the Internet. To run Combofix go offline, shut down your McAfee antivirus, run Combofix, restart the computer to get McAfee up and running again, get online and post the Combofix log please. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

0

ComboFix 08-08-24.03 - Hassaan 2008-08-26 12:28:56.8 - NTFSx86 Running from: C:\Documents and Settings\Hassaan\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))) . 2008-08-25 20:05 . 2008-08-25 20:07 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-25 20:05 . 2008-08-25 20:05 <DIR> d-------- C:\Documents and Settings\Hassaan\Application Data\Malwarebytes 2008-08-25 20:05 . 2008-08-25 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-25 20:05 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-25 20:05 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-25 00:54 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-25 00:51 . 2008-08-25 00:54 <DIR> d-------- C:\Program Files\Java 2008-08-25 00:51 . 2008-08-25 00:51 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-20 18:38 . 2008-08-20 18:38 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-20 18:38 . 2008-08-20 18:38 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-19 23:23 . 2008-08-19 23:23 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-08-17 03:02 . 2008-08-25 20:09 <DIR> d-------- C:\Program Files\Ontrack 2008-08-14 11:23 . 2008-08-14 11:23 <DIR> d-------- C:\log 2008-08-08 16:07 . 2008-08-08 16:07 286,720 --------- C:\WINDOWS\Setup1.exe 2008-08-08 16:07 . 2008-08-08 16:07 73,216 --a------ C:\WINDOWS\ST6UNST.exe 2008-08-07 19:53 . 2008-08-07 20:03 <DIR> d-------- C:\Documents and Settings\Hassaan\.netvis 2008-08-07 19:50 . 2008-08-07 19:50 <DIR> d-------- C:\Program Files\RouterSim . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 10:52 --------- d-----w C:\Program Files\VideoMate 2008-08-18 21:54 --------- d-----w C:\Documents and Settings\Hassaan\Application Data\dvdcss 2008-08-16 22:02 49,152 ----a-w C:\WINDOWS\uninstal.exe 2008-08-12 13:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-08-09 11:30 19,016 ----a-w C:\Documents and Settings\Hassaan\Application Data\GDIPFONTCACHEV1.DAT 2008-08-08 10:19 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-04 13:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-05-27 12:03 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-27 12:03 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-02-22 20:00 19,064 ----a-w C:\Documents and Settings\aaa.NONAME\Application Data\GDIPFONTCACHEV1.DAT 2007-07-08 08:24 2,643,424 ----a-w C:\Program Files\Age2upA.exe 2007-04-21 03:52 17,152 ----a-w C:\Documents and Settings\bbb\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-04-07 05:19 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-04-07 05:07 114688] "VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18 151552] "VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 12:49 163840] "OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02 53248] "MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 303104] "MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05 212992] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-27 17:02 185896] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll "vidc.VP31"= vp31vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "F:\\Age Of Empire-II\\Empires2.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "D:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\IEPro\\MiniDM.exe"= "F:\\Lime\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= R2 IBService;IBService;d:\Program Files\Invisible Browsing\servers\IBService.exe [2007-01-09 14:38] S1 CXAVSAUD;Compro VideoMate X series Audio Capture;C:\WINDOWS\system32\DRIVERS\cxavsaud.sys [2006-03-22 15:07] S3 WebSTARNdis;WebSTAR DPX USB Cable Modem Adapter;C:\WINDOWS\system32\DRIVERS\WebSTAR.sys [2001-12-17 16:25] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b86b350-e567-11db-b99e-00407b7973d5}] \Shell\AutoRun\command - K:\m88coaim.exe \Shell\explore\Command - K:\m88coaim.exe \Shell\open\Command - K:\m88coaim.exe *Newly Created Service* - CATCHME . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Hassaan\Application Data\Mozilla\Firefox\Profiles\xmrnlfiq.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-26 12:32:57 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-26 12:38:08 ComboFix-quarantined-files.txt 2008-08-26 07:37:31 ComboFix2.txt 2008-08-14 10:18:20 Pre-Run: 3,006,251,008 bytes free Post-Run: 3,028,811,776 bytes free 112 --- E O F --- 2008-08-15 05:09:00

0

Should I alert you every time I post a response?

0

I look for post for about two days, any longer than that you should alert me. Copy the text below between the X's into notepad, making sure the first line is at the top off the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX attrib -r -a -s -h *.* /s /d del /a /f K:\m88coaim.exe del /a /f K:\autorun.inf XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Once copied into notepad click file> save> in the save in box select desktop then in the file name box type joe.bat then click save. You should now have a joe.bat file on you desktop. If not let me know. Double click the joe.bat file, it will run in about a second. Now, open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b86b350-e567-11db-b99e-00407b7973d5}] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply.

0

Here's the log produced by ComboFix ---------------- ComboFix 08-08-24.03 - Hassaan 2008-08-27 16:41:49.9 - NTFSx86 Running from: C:\Documents and Settings\Hassaan\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Hassaan\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))) . 2008-08-25 20:05 . 2008-08-25 20:07 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-25 20:05 . 2008-08-25 20:05 <DIR> d-------- C:\Documents and Settings\Hassaan\Application Data\Malwarebytes 2008-08-25 20:05 . 2008-08-25 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-25 20:05 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-25 20:05 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-25 00:54 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-25 00:51 . 2008-08-25 00:54 <DIR> d-------- C:\Program Files\Java 2008-08-25 00:51 . 2008-08-25 00:51 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-20 18:38 . 2008-08-27 01:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-20 18:38 . 2008-08-20 18:38 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-19 23:23 . 2008-08-19 23:23 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-08-17 03:02 . 2008-08-25 20:09 <DIR> d-------- C:\Program Files\Ontrack 2008-08-14 11:23 . 2008-08-14 11:23 <DIR> d-------- C:\log 2008-08-08 16:07 . 2008-08-08 16:07 286,720 --------- C:\WINDOWS\Setup1.exe 2008-08-08 16:07 . 2008-08-08 16:07 73,216 --a------ C:\WINDOWS\ST6UNST.exe 2008-08-07 19:53 . 2008-08-07 20:03 <DIR> d-------- C:\Documents and Settings\Hassaan\.netvis 2008-08-07 19:50 . 2008-08-07 19:50 <DIR> d-------- C:\Program Files\RouterSim . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 10:52 --------- d-----w C:\Program Files\VideoMate 2008-08-18 21:54 --------- d-----w C:\Documents and Settings\Hassaan\Application Data\dvdcss 2008-08-16 22:02 49,152 ----a-w C:\WINDOWS\uninstal.exe 2008-08-12 13:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-08-09 11:30 19,016 ----a-w C:\Documents and Settings\Hassaan\Application Data\GDIPFONTCACHEV1.DAT 2008-08-08 10:19 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-04 13:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-05-27 12:03 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-27 12:03 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-02-22 20:00 19,064 ----a-w C:\Documents and Settings\aaa.NONAME\Application Data\GDIPFONTCACHEV1.DAT 2007-07-08 08:24 2,643,424 ----a-w C:\Program Files\Age2upA.exe 2007-04-21 03:52 17,152 ----a-w C:\Documents and Settings\bbb\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((( snapshot@2008-08-26_12.35.00.98 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-26 07:08:51 223,830 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2008-08-27 10:52:28 223,826 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-04-07 05:19 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-04-07 05:07 114688] "VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18 151552] "VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 12:49 163840] "OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02 53248] "MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 303104] "MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05 212992] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-27 17:02 185896] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll "vidc.VP31"= vp31vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "F:\\Age Of Empire-II\\Empires2.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "D:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\IEPro\\MiniDM.exe"= "F:\\Lime\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= R2 IBService;IBService;d:\Program Files\Invisible Browsing\servers\IBService.exe [2007-01-09 14:38] R3 WebSTARNdis;WebSTAR DPX USB Cable Modem Adapter;C:\WINDOWS\system32\DRIVERS\WebSTAR.sys [2001-12-17 16:25] S1 CXAVSAUD;Compro VideoMate X series Audio Capture;C:\WINDOWS\system32\DRIVERS\cxavsaud.sys [2006-03-22 15:07] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-27 16:46:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-27 16:51:20 ComboFix-quarantined-files.txt 2008-08-27 11:50:14 ComboFix2.txt 2008-08-26 07:38:21 ComboFix3.txt 2008-08-14 10:18:20 Pre-Run: 2,957,484,032 bytes free Post-Run: 2,951,053,312 bytes free 109 --- E O F --- 2008-08-15 05:09:00

0

Now here's the Kaspersky log: ---------------------- KASPERSKY ONLINE SCANNER 7 REPORT Thursday, August 28, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Wednesday, August 27, 2008 18:20:32 Records in database: 1151835 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics: Files scanned: 144763 Threat name: 5 Infected objects: 28 Suspicious objects: 0 Duration of the scan: 05:04:16 File name / Threat name / Threats count D:\autorun.inf Infected: Virus.Win32.AutoRun.abt 1 D:\smss.exe Infected: Worm.Win32.AutoRun.ek 1 D:\ntde1ect.com Infected: Packed.Win32.NSAnti.r 1 D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003159.inf Infected: Virus.Win32.AutoRun.abt 1 D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003181.inf Infected: Virus.Win32.AutoRun.abt 1 D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003193.com Infected: Packed.Win32.NSAnti.r 1 D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0003216.com Infected: Packed.Win32.NSAnti.r 1 D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0004192.inf Infected: Virus.Win32.AutoRun.abt 1 D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0004209.com Infected: Packed.Win32.NSAnti.r 1 E:\ntde1ect.com Infected: Packed.Win32.NSAnti.r 1 E:\smss.exe Infected: Worm.Win32.AutoRun.ek 1 E:\autorun.inf Infected: Virus.Win32.AutoRun.abt 1 E:\System Volume Information\_restore{D81FC5BC-2D78-4CBC-95D4-1E5F785997EC}\RP91\A0057837.exe Infected: not-a-virus:AdWare.Win32.EZula.bh 1 E:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003182.inf Infected: Virus.Win32.AutoRun.abt 1 E:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003194.com Infected: Packed.Win32.NSAnti.r 1 E:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0003217.com Infected: Packed.Win32.NSAnti.r 1 E:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0004193.inf Infected: Virus.Win32.AutoRun.abt 1 E:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0004210.com Infected: Packed.Win32.NSAnti.r 1 F:\yehai\My Received Files\key finder\kf141.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 2 F:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003183.inf Infected: Virus.Win32.AutoRun.abt 1 F:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003195.com Infected: Packed.Win32.NSAnti.r 1 F:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0003218.com Infected: Packed.Win32.NSAnti.r 1 F:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0004195.inf Infected: Virus.Win32.AutoRun.abt 1 F:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP7\A0004211.com Infected: Packed.Win32.NSAnti.r 1 F:\autorun.inf Infected: Virus.Win32.AutoRun.abt 1 F:\smss.exe Infected: Worm.Win32.AutoRun.ek 1 F:\ntde1ect.com Infected: Packed.Win32.NSAnti.r 1 The selected area was scanned.

0

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX KILLALL:: File:: D:\autorun.inf D:\smss.exe D:\ntde1ect.com E:\ntde1ect.com E:\smss.exe E:\autorun.inf F:\autorun.inf F:\smss.exe F:\ntde1ect.com XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Post a new Combofix log. Empty the restore folder. Go to start>control panel>system>system restore tab> select the D, E, and F drives> check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Run the Kaspersky scan again, you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component.

0

ComboFix log ------------ ComboFix 08-08-24.03 - Hassaan 2008-08-28 17:56:07.10 - NTFSx86 Running from: C:\Documents and Settings\Hassaan\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Hassaan\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: D:\autorun.inf D:\ntde1ect.com D:\smss.exe E:\autorun.inf E:\ntde1ect.com E:\smss.exe F:\autorun.inf F:\ntde1ect.com F:\smss.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\autorun.inf D:\ntde1ect.com D:\smss.exe E:\autorun.inf E:\ntde1ect.com E:\smss.exe F:\autorun.inf F:\ntde1ect.com F:\smss.exe . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-28 ))))))))))))))))))))))))))))))) . 2008-08-25 20:05 . 2008-08-25 20:07 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-25 20:05 . 2008-08-25 20:05 <DIR> d-------- C:\Documents and Settings\Hassaan\Application Data\Malwarebytes 2008-08-25 20:05 . 2008-08-25 20:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-25 20:05 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-25 20:05 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-25 00:54 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-25 00:51 . 2008-08-25 00:54 <DIR> d-------- C:\Program Files\Java 2008-08-25 00:51 . 2008-08-25 00:51 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-20 18:38 . 2008-08-27 01:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-20 18:38 . 2008-08-20 18:38 1,409 --a------ C:\WINDOWS\QTFont.for 2008-08-19 23:23 . 2008-08-19 23:23 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-08-17 03:02 . 2008-08-25 20:09 <DIR> d-------- C:\Program Files\Ontrack 2008-08-14 11:23 . 2008-08-14 11:23 <DIR> d-------- C:\log 2008-08-08 16:07 . 2008-08-08 16:07 286,720 --------- C:\WINDOWS\Setup1.exe 2008-08-08 16:07 . 2008-08-08 16:07 73,216 --a------ C:\WINDOWS\ST6UNST.exe 2008-08-07 19:53 . 2008-08-07 20:03 <DIR> d-------- C:\Documents and Settings\Hassaan\.netvis 2008-08-07 19:50 . 2008-08-07 19:50 <DIR> d-------- C:\Program Files\RouterSim . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 10:52 --------- d-----w C:\Program Files\VideoMate 2008-08-18 21:54 --------- d-----w C:\Documents and Settings\Hassaan\Application Data\dvdcss 2008-08-16 22:02 49,152 ----a-w C:\WINDOWS\uninstal.exe 2008-08-12 13:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-08-09 11:30 19,016 ----a-w C:\Documents and Settings\Hassaan\Application Data\GDIPFONTCACHEV1.DAT 2008-08-08 10:19 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-04 13:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-02-22 20:00 19,064 ----a-w C:\Documents and Settings\aaa.NONAME\Application Data\GDIPFONTCACHEV1.DAT 2007-07-08 08:24 2,643,424 ----a-w C:\Program Files\Age2upA.exe 2007-04-21 03:52 17,152 ----a-w C:\Documents and Settings\bbb\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((( snapshot@2008-08-26_12.35.00.98 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-26 07:08:51 223,830 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2008-08-28 14:04:04 223,833 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-04-07 05:19 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-04-07 05:07 114688] "VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18 151552] "VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 12:49 163840] "OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02 53248] "MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 303104] "MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05 212992] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-27 17:02 185896] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll "vidc.VP31"= vp31vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "F:\\Age Of Empire-II\\Empires2.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "D:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\IEPro\\MiniDM.exe"= "F:\\Lime\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= R2 IBService;IBService;d:\Program Files\Invisible Browsing\servers\IBService.exe [2007-01-09 14:38] R3 WebSTARNdis;WebSTAR DPX USB Cable Modem Adapter;C:\WINDOWS\system32\DRIVERS\WebSTAR.sys [2001-12-17 16:25] S1 CXAVSAUD;Compro VideoMate X series Audio Capture;C:\WINDOWS\system32\DRIVERS\cxavsaud.sys [2006-03-22 15:07] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-28 19:04:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> ?:\WINDOWS\system32\SETUPAPI.dll . r Running Proce . C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\system32\Crypserv.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe D:\Program Files\Invisible Browsing\servers\Socks\IBSocksManager.exe C:\Program Files\McAfee.com\Agent\Mcdetect.exe C:\PROGRA~1\McAfee.com\VSO\McShield.exe C:\PROGRA~1\McAfee.com\Agent\McTskshd.exe D:\Program Files\Invisible Browsing\servers\Http\ibhttp.exe D:\Program Files\Invisible Browsing\servers\Socks\IBSocks.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\PROGRA~1\McAfee.com\VSO\McVSEscn.exe C:\Program Files\McAfee.com\Agent\mcagent.exe . ************************************************************************** . Completion time: 2008-08-28 19:16:41 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-28 14:16:28 ComboFix2.txt 2008-08-27 11:51:21 ComboFix3.txt 2008-08-26 07:38:21 ComboFix4.txt 2008-08-14 10:18:20 Pre-Run: 2,970,697,728 bytes free Post-Run: 3,014,397,952 bytes free 148 --- E O F --- 2008-08-15 05:09:00

0

I tried to empty the system restore folders on d,e and f the way you told me to, but it didn't work. They are still the same size. Do I delete them manually?

0

The size would be the same after you turned system restore back on as it is a provided space not dependant on file size or amount of files. They should be clean if you selected each drive and followed the procedure. If you do not think they were cleaned purge each drive independantly.

0

I didn't get it; the 'System Volume Information' folders on each drive contain subfolders, which are the restore points which I can switch back to in case something goes wrong or I want to get back to the settings I had.. let's say a week ago, right? When I checked 'Turn off System Restore on all drives', all the subfolders in each 'System Volume Information' folder on each drive should've been deleted, right? Correct me if I'm wrong. Emptying the 'Restore Folders' means that they shouldn't contain anything i.e. their size should be 0, just like the 'System Volume Information' folder on my C: drive. My confusion is that when i checked 'Turn off System Restore on all drives', why only the folder on C: was emptied? The folder on D: is around 350MB, the ones on E: and F: are around 650MB each - WASTAGE of so much space, isn't it? It was really annoying me, so I've deleted all the subfolders manually and freed a lot of space on my drives. I hope I haven't done anything that'll have detrimental consequences.

0

I don't believe you hurt anything as they will probably be rebuilt. Are drive D, E and F actually hard drives or are they jump drives. It they were jump/pen drives they probably contained viri anyway and is doesn't make any differance if they were deleted. I they are hard drives windows will rebuild them if you did not adjust the provide space to less than needed to copy the info on the drives i believe. How is the computer operating?

0

The computer is operating fine. C,D,E,F are 4 partitions(10GB each) on my hard drive of 40GB. All I did was go to 'System Volume Information' folder on each drive(excluding C) and delete all the subfolders without adjusting anything like the provide space or whatever. I did this after checking 'Turn off System Restore on all drives' and it's still off. Should I turn it back on before running Kaspersky?

0

Yes turn it back on, it is easy to empty it again and difficult (actually just time consuming) to reinstall your system.

0

If you want to get an idea of how slow my computer is, just look at the duration of this scan; it took more than 6 and a 1/2 HOURS to complete in spite of the fact that I emptied all the restore folders. Is there anything on earth I can do to speed up this absolutely crap computer of mine? It's making me pull my hair out! Here's the log ---------------------- KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, September 2, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, September 01, 2008 20:57:20 Records in database: 1175380 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics: Files scanned: 142750 Threat name: 4 Infected objects: 12 Suspicious objects: 0 Duration of the scan: 06:35:11 File name / Threat name / Threats count D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003159.inf Infected: Virus.Win32.AutoRun.abt 1 D:\Qoobox\Quarantine\D\autorun.inf.vir Infected: Virus.Win32.AutoRun.abt 1 D:\Qoobox\Quarantine\D\ntde1ect.com.vir Infected: Packed.Win32.NSAnti.r 1 D:\Qoobox\Quarantine\D\smss.exe.vir Infected: Worm.Win32.AutoRun.ek 1 E:\Qoobox\Quarantine\E\autorun.inf.vir Infected: Virus.Win32.AutoRun.abt 1 E:\Qoobox\Quarantine\E\ntde1ect.com.vir Infected: Packed.Win32.NSAnti.r 1 E:\Qoobox\Quarantine\E\smss.exe.vir Infected: Worm.Win32.AutoRun.ek 1 F:\yehai\My Received Files\key finder\kf141.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 2 F:\Qoobox\Quarantine\F\autorun.inf.vir Infected: Virus.Win32.AutoRun.abt 1 F:\Qoobox\Quarantine\F\ntde1ect.com.vir Infected: Packed.Win32.NSAnti.r 1 F:\Qoobox\Quarantine\F\smss.exe.vir Infected: Worm.Win32.AutoRun.ek 1 The selected area was scanned.

0

I don't see anything. Empty the restore "D:" drive folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Go to start> run> type in combofix /u (note the space after combofix) the press enter. Give it a minute. This will uninstall Combofix. Go to start> control panel> add/remove programs and uninstall Hijack This, you should keep Malwarebytes and AFT Cleaner and run them weekly.

0

What about these: File name / Threat name / Threats count D:\System Volume Information\_restore{9E1B1E53-404E-4EEC-A9B9-03550CE3400A}\RP6\A0003159.inf Infected: Virus.Win32.AutoRun.abt 1 D:\Qoobox\Quarantine\D\autorun.inf.vir Infected: Virus.Win32.AutoRun.abt 1 D:\Qoobox\Quarantine\D\ntde1ect.com.vir Infected: Packed.Win32.NSAnti.r 1 D:\Qoobox\Quarantine\D\smss.exe.vir Infected: Worm.Win32.AutoRun.ek 1 E:\Qoobox\Quarantine\E\autorun.inf.vir Infected: Virus.Win32.AutoRun.abt 1 E:\Qoobox\Quarantine\E\ntde1ect.com.vir Infected: Packed.Win32.NSAnti.r 1 E:\Qoobox\Quarantine\E\smss.exe.vir Infected: Worm.Win32.AutoRun.ek 1 F:\yehai\My Received Files\key finder\kf141.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 2 F:\Qoobox\Quarantine\F\autorun.inf.vir Infected: Virus.Win32.AutoRun.abt 1 F:\Qoobox\Quarantine\F\ntde1ect.com.vir Infected: Packed.Win32.NSAnti.r 1 F:\Qoobox\Quarantine\F\smss.exe.vir Infected: Worm.Win32.AutoRun.ek 1 Some more things I need to ask you bro: - I have McAfee SecurityCenter installed on my system which I think is one of the reasons my computer is really slow. Do you think I should stick with this antivirus or you would suggest some other antivirus? - My internet connection sometimes shows 'Limited or no connectivity message'. I called my ISP to inquire about the problem and I was told that I should always keep my windows firewall off as it is of no use. I kept it off for a few days and didn't get the limited connectivity message, but now I've turned it back on and still my internet connection is working fine. What do you suggest on this -- is it safe to turn the firewall off? - When I click on 'Add or Remove Programs', the 'Currently installed programs' list shows me 'Ask Toolbar' which I had deleted from the program files. When I click on 'Remove', it says: "Error loading C:\PROGRA~1\AskSBar\bar\1.bin\AskSBar.dll The specified module could not be found." What do I do to remove it?

0

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Go to start> run> type in Combofix /u (note the space after combofix) then press enter. Give it a minute to run. This should uninstall combofix along with the C:\Qoobox folder. Navigate to C:\ and delete the Qoobox folder if it still exist. You can delete this if you did not install the keyfinder: F:\yehai\My Received Files\key finder\kf141.zip If you did not install it delete the "key finder" folder. I would unistall McAfee if I didn't have any money invested in it. I use the free version of AVG, you can download it at this link: AVG Free Antivirus Update it once you get it installed. You need to run the firewall. For connectivity go start > run type cmd and press enter or ok. type ipconfig /flushdns <-- (The space between g and / is needed) Then press Enter, type Exit, press Enter again If you have a ASDL modem or a router Power both of them down for 30 secs. Plug them back and reconnect. That sometimes helps. Navigate to and delete this folder if found: C:\Program Files\AsKSbar ...and see if that stops the error.

0

I really appreciate all the help you've provided me to clean my computer bro. But there is one problem that still remains; the one I mentioned about in Response Number 2: "whenever I close an explorer window e.g. My Computer or My Documents, all my desktop icons and taskbar disappear for a couple of seconds. But it doesn't happen when i have multiple windows open and I close them - means it only happens when I open just one explorer window and then close it."

0

Please that question on the xp section of the forum as it sounds more like a windows problem.

0

The same viruses you helped me get rid of were transferred to my other PC through a pen drive. The viruses were causing problems like closing my taskmanager and interrupting any software installations. I ran ComboFix once and it seems to have fixed the problem, but I'm not sure that the viruses have been completely removed. What do I do next?

0

Start a new thread on the second computer, state only the problem. You do not need to run Combofix on your computer without following a helpers advice as some programs will cause it to hang if they are running while Combofix is running and can trash the computer.

0