Virus Total found the following infections in C:\WINDOWS\system32\setup.ini : NOD32v2 2894 2008.02.21 INF/Autorun Sophos 4.26.0 2008.02.22 Sus/AutoInf-A The rest came out clean. And here are the results of the Kaspersky online scanner: --------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, February 23, 2008 10:58:34 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 22/02/2008 Kaspersky Anti-Virus database records: 576041 --------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 129896 Number of viruses found: 5 Number of infected objects: 65 Number of suspicious objects: 0 Duration of the scan process: 02:16:32 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_NAV.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Navin\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\cert8.db Object is locked skipped C:\Documents and Settings\Navin\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Navin\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\history.dat Object is locked skipped C:\Documents and Settings\Navin\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\key3.db Object is locked skipped C:\Documents and Settings\Navin\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\parent.lock Object is locked skipped C:\Documents and Settings\Navin\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\search.sqlite Object is locked skipped C:\Documents and Settings\Navin\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Navin\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\Music n Video\Nero 7.8.5.0 Ultra Incl Keygen NEW!!!\Nero 7.8.5.0 Ultra.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\Music n Video\Nero 7.8.5.0 Ultra Incl Keygen NEW!!!\Nero 7.8.5.0 Ultra.exe RAR: infected - 1 skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\s2k.7.1.plus.zip/setup.exe Infected: not-a-virus:AdWare.Win32.BHO.aa skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\s2k.7.1.plus.zip ZIP: infected - 1 skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\Vista Transformation Pack 5.5.exe/WISE0039.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\Vista Transformation Pack 5.5.exe/WISE0058.BIN/WISE0005.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\Vista Transformation Pack 5.5.exe/WISE0058.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\Documents and Settings\Navin\Desktop\Extras\Setup Files\Vista Transformation Pack 5.5.exe WiseSFX: infected - 3 skipped C:\Documents and Settings\Navin\Desktop\New Folder\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files.exe/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\Documents and Settings\Navin\Desktop\New Folder\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files.exe/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\Documents and Settings\Navin\Desktop\New Folder\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files.exe Embedded: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files\CRM News RFID RFID Tags Preventing or Promoting Identity Theft_files.exe UPX: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\Help removing and preventing spyware - Killbox_files\Help removing and preventing spyware - Killbox_files.exe/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\Documents and Settings\Navin\Desktop\New Folder\Help removing and preventing spyware - Killbox_files\Help removing and preventing spyware - Killbox_files.exe/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\Documents and Settings\Navin\Desktop\New Folder\Help removing and preventing spyware - Killbox_files\Help removing and preventing spyware - Killbox_files.exe Embedded: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\Help removing and preventing spyware - Killbox_files\Help removing and preventing spyware - Killbox_files.exe UPX: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Folder.exe/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Folder.exe/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Folder.exe Embedded: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Folder.exe UPX: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Malware_j virus on XP - Geeks to Go!_files\New Malware_j virus on XP - Geeks to Go!_files.exe/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Malware_j virus on XP - Geeks to Go!_files\New Malware_j virus on XP - Geeks to Go!_files.exe/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Malware_j virus on XP - Geeks to Go!_files\New Malware_j virus on XP - Geeks to Go!_files.exe Embedded: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\New Malware_j virus on XP - Geeks to Go!_files\New Malware_j virus on XP - Geeks to Go!_files.exe UPX: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\Debating 'designer babies'_files\Debating 'designer babies'_files.exe/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\Debating 'designer babies'_files\Debating 'designer babies'_files.exe/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\Debating 'designer babies'_files\Debating 'designer babies'_files.exe Embedded: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\Debating 'designer babies'_files\Debating 'designer babies'_files.exe UPX: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\pm.exe/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\pm.exe/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\pm.exe Embedded: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\pm.exe UPX: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\The Trouble with RFID_files\The Trouble with RFID_files.exe/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\The Trouble with RFID_files\The Trouble with RFID_files.exe/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\The Trouble with RFID_files\The Trouble with RFID_files.exe Embedded: infected - 2 skipped C:\Documents and Settings\Navin\Desktop\New Folder\pm\The Trouble with RFID_files\The Trouble with RFID_files.exe UPX: infected - 2 skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Ares\My Shared Folder\___ARESTRA___09 - middle of the night.mp3 Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Ares\My Shared Folder\___ARESTRA___kendall payne - scratch(2).mp3 Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Messenger\navinsasikumar@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Messenger\navinsasikumar@hotmail.com\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Messenger\navinsasikumar@hotmail.com\SharingMetadata\Working\database_8E08_E819_8E8_1D7\dfsr.db Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Messenger\navinsasikumar@hotmail.com\SharingMetadata\Working\database_8E08_E819_8E8_1D7\fsr.log Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Messenger\navinsasikumar@hotmail.com\SharingMetadata\Working\database_8E08_E819_8E8_1D7\tmp.edb Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Windows Live Contacts\navinsasikumar@hotmail.com\real\members.stg Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Microsoft\Windows Live Contacts\navinsasikumar@hotmail.com\shadow\members.stg Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Mozilla\Firefox\Profiles\ujs22jev.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Yahoo\Widget Engine\Widget Data\Yahoo! Weather\location data.db Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Application Data\Yahoo\Widget Engine\Widgets DB\widgets.db Object is locked skipped C:\Documents and Settings\Navin\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Navin\Local Settings\History\History.IE5\MSHist012008022220080223\index.dat Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temp\Free Download Manager\tic27.tmp Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temp\Free Download Manager\ticB.tmp Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temp\~DF4D5E.tmp Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temp\~DF4D6B.tmp Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temp\~DF5EA3.tmp Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temp\~DF5EF5.tmp Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Navin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Navin\ntuser.dat Object is locked skipped C:\Documents and Settings\Navin\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Oracle\app\oracle\product\10.2.0\server\database\hc_xe.dat Object is locked skipped C:\Oracle\app\oracle\product\10.2.0\server\NETWORK\log\listener.log Object is locked skipped C:\Oracle\app\oracle\product\10.2.0\server\oramts\trace\OracleMTSRecoveryService(1736).trc Object is locked skipped C:\Oracle\oradata\XE\CONTROL.DBF Object is locked skipped C:\Oracle\oradata\XE\LOG1.DBF Object is locked skipped C:\Oracle\oradata\XE\LOG2.DBF Object is locked skipped C:\Oracle\oradata\XE\LOG3.DBF Object is locked skipped C:\Oracle\oradata\XE\SYSAUX.DBF Object is locked skipped C:\Oracle\oradata\XE\SYSTEM.DBF Object is locked skipped C:\Oracle\oradata\XE\TEMP.DBF Object is locked skipped C:\Oracle\oradata\XE\UNDO.DBF Object is locked skipped C:\Oracle\oradata\XE\USERS.DBF Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\regsvr.exe.vir/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\QooBox\Quarantine\C\WINDOWS\regsvr.exe.vir/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\QooBox\Quarantine\C\WINDOWS\regsvr.exe.vir Embedded: infected - 2 skipped C:\QooBox\Quarantine\C\WINDOWS\regsvr.exe.vir UPX: infected - 2 skipped C:\QooBox\Quarantine\C\WINDOWS\system32\regsvr.exe.vir/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\QooBox\Quarantine\C\WINDOWS\system32\regsvr.exe.vir/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\QooBox\Quarantine\C\WINDOWS\system32\regsvr.exe.vir Embedded: infected - 2 skipped C:\QooBox\Quarantine\C\WINDOWS\system32\regsvr.exe.vir UPX: infected - 2 skipped C:\QooBox\Quarantine\C\WINDOWS\system32\rundll.exe.vir Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\QooBox\Quarantine\C\WINDOWS\system32\winhelp.exe.vir/script.au3 Infected: Worm.Win32.AutoIt.s skipped C:\QooBox\Quarantine\C\WINDOWS\system32\winhelp.exe.vir/C:\rundll.exe Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\QooBox\Quarantine\C\WINDOWS\system32\winhelp.exe.vir Embedded: infected - 2 skipped C:\QooBox\Quarantine\C\WINDOWS\system32\winhelp.exe.vir UPX: infected - 2 skipped C:\quarantine\A0041722.exe.Vir Object is locked skipped C:\quarantine\registrydistiller.exe.Vir Object is locked skipped C:\quarantine\rundll.exe.Vir Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.0 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.1 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.10 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.11 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.2 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.3 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.4 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.5 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.6 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.7 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.8 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\quarantine\rundll.exe.Vir.9 Infected: not-a-virus:Monitor.Win32.007SpySoft.g skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{C3E62C65-AA52-4324-B832-6CFB0ABF3497}\RP324\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_Nokia 6288 USB Modem.txt Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{7704E3EA-A303-42BA-8B24-D2090B584AA0}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\closeapp.exe Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\vimc.exe/WISE0005.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\WINDOWS\system32\vimc.exe WiseSFX: infected - 1 skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\TempFile Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. And the comboFix log after i did the CFScript thing: ComboFix 08-02-21 - Navin 2008-02-22 12:58:43.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.390 [GMT 5.5:30] Running from: C:\Downloads\ComboFix.exe Command switches used :: C:\Documents and Settings\Navin\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\regsvr.exe C:\WINDOWS\system32\regsvr.exe C:\WINDOWS\Tasks\At1.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\regsvr.exe C:\WINDOWS\system32\regsvr.exe C:\WINDOWS\system32\ssdata C:\WINDOWS\system32\ssdata\Apps.dat C:\WINDOWS\system32\ssdata\Files.dat C:\WINDOWS\system32\ssdata\kys.dat C:\WINDOWS\system32\ssdata\lgstat.ini C:\WINDOWS\system32\ssdata\scr.dat C:\WINDOWS\system32\ssdata\scrdata\2008022228510.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228541.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228571.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228601.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228631.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228661.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228691.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228721.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228751.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228901.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228931.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228961.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022228992.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022229022.jpg C:\WINDOWS\system32\ssdata\scrdata\2008022229059.jpg C:\WINDOWS\Tasks\At1.job . ((((((((((((((((((((((((( Files Created from 2008-01-22 to 2008-02-22 ))))))))))))))))))))))))))))))) . 2008-02-21 17:43 . 2008-02-21 17:43 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-02-21 17:43 . 2008-02-21 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-02-21 17:42 . 2008-02-21 17:43 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-02-20 21:22 . 2008-02-20 21:22 74,383,822 --a------ C:\20_2.reg 2008-02-20 21:12 . 2008-02-20 21:12 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-19 22:41 . 2008-02-19 22:41 <DIR> d--h----- C:\Settings 2008-02-19 21:22 . 2008-02-19 21:22 711 --a------ C:\Settings.ini 2008-02-18 21:29 . 2008-02-18 21:29 96 -rahs---- C:\WINDOWS\system32\setup.ini 2008-02-11 21:40 . 2008-02-11 21:44 <DIR> d-------- C:\Oracle . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-22 07:30 --------- d-----w C:\Documents and Settings\Navin\Application Data\Free Download Manager 2008-02-18 12:54 --------- d-----w C:\Documents and Settings\Navin\Application Data\BitTorrent 2008-02-11 16:19 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-25 06:34 --------- d-----w C:\Program Files\SolidWorks 2008-01-17 21:17 --------- d-----w C:\Documents and Settings\Navin\Application Data\BitTorrent DNA 2008-01-07 16:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-01-02 18:53 --------- d-----w C:\Program Files\BitTorrent_DNA 2008-01-02 18:53 --------- d-----w C:\Program Files\BitTorrent 2008-01-02 13:03 --------- d-----w C:\Documents and Settings\Navin\Application Data\Microsoft Games 2007-12-29 18:35 --------- d-----w C:\Program Files\Stardock 2007-12-29 18:35 --------- d-----w C:\Program Files\Common Files\Stardock 2007-12-25 05:45 --------- d-----w C:\Program Files\Common Files\xing shared 2007-12-25 05:45 --------- d-----w C:\Program Files\Common Files\Real 2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-07-18 18:40 1,098 ----a-w C:\Documents and Settings\Navin\Application Data\wklnhst.dat 2007-04-02 17:03 5,632 --sha-w C:\Program Files\Thumbs.db . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [2007-04-12 05:20 947200] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2006-08-21 00:24 2068527] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:30 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-12-13 17:44 98304] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-12-13 17:41 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-12-13 17:45 118784] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-12-06 10:45 839680] "ShowLOMControl"="1 (0x1)" [] "SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 15:35 397312 C:\WINDOWS\stsystra.exe] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 12:56 761947] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48 32881] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 09:08 1347584] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-03-16 05:33 127037] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184] "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2003-03-06 07:00 90182] "LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27 65536] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-25 11:15 185896] "User Themes"="C:\WINDOWS\system32\rundll.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 15:30 53760 C:\WINDOWS\system32\narrator.exe] C:\Documents and Settings\Navin\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-12-30 00:05:31 3450608] Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe [2007-07-20 23:27:16 2913584] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-01-03 00:23 274240 C:\Program Files\BitTorrent_DNA\dna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2006-06-15 12:36 229376 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-12-25 11:15 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "SSScsiSV"=3 (0x3) "Spooler"=2 (0x2) "ERSvc"=2 (0x2) R2 OracleJobSchedulerXE;OracleJobSchedulerXE;c:\oracle\app\oracle\product\10.2.0\server\Bin\extjob.exe XE [] R2 OracleServiceXE;OracleServiceXE;c:\oracle\app\oracle\product\10.2.0\server\bin\ORACLE.exe XE [] R2 OracleXETNSListener;OracleXETNSListener;C:\Oracle\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe [2005-10-08 06:26] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10fc1320-d535-11db-8880-0018de94c187}] \Shell\AutoRun\command - F:\LaunchU3.exe -a *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-02-13 11:26:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-22 07:08:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-22 13:01:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... disk error: C:\WINDOWS\ ************************************************************************** . Completion time: 2008-02-22 13:02:39 ComboFix-quarantined-files.txt 2008-02-22 07:31:47 ComboFix2.txt 2008-02-22 02:46:22 . 2008-02-19 15:48:50 --- E O F --- Or do you want me to me to run combofix all over again? The error message no longer comes up and my mcafee does not show new malware.j infection any more. Thanks a lot for all your help.

0

Looks like there are still some infections. Do you know what this folder is: C:\Documents and Settings\Navin\Desktop\New Folder And are you running the "Vista Transformation Pack 6.0"?

0

I know what the folder C:\Documents and Settings\Navin\Desktop\New Folder is, but there is an executable file in it called New Folder.exe which i don't know about. And yes, I am running Vista Transformation Pack...does that cause problems?

0

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\Documents and Settings\Navin\Desktop\New Folder\New Folder.exe C:\Documents and Settings\Navin\Desktop\New Folder\pm\pm.exe C:\WINDOWS\system32\setup.ini Folder:: C:\QooBox C:\quarantine XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Let us know how the computer is operating.

0

Thanx a lot. The computer seems to be operating just fine. No more error/ virus messages. Anything else i need to do to make sure my computer is completely clean?

0

Your java is out of date and can be exploited. Download the latest version of java from this link Java Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-1_6_3-windowsi586-p.exe to install the newest version. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version. Glad we could help.

0

hi .. i get a message everytime saying there is there is some Worm.It.s .. it mainly says prob with regsvr.exe setting.ini help.exe but i couldnt make it rite using any spyware .. can u help.. i ve tried the hijack and combo fix.. whats my next move.. help me out..

0